OAA-26-00349 - OCIO AI Engineering Services.docx

Sources Sought & Request for Information (RFI) DESCRIPTION: Artificial Intelligence (AI) Engineering Services REQUIRING AGENCY: Department of Labor (DOL) Office of the Assistant Secretary for Administration and Management (OASAM) Office of the Chief Information Officer (OCIO) NOTICE TYPE: Sources Sought / RFI CLASSIFICATION CODE: D - Information Technology Services NAICS CODE: North American Industry Classification System (NAICS) 541512 - Computer Systems Design Services SIZE STANDARD: $34 Million PLACE OF PERFORMANCE: Washington, DC 20210 (200 Constitution Ave NW); Telework authorized case-by-case.

PART I — SYNOPSIS AND DESCRIPTION OF REQUIREMENT

The U.S. DOL OCIO, within the OASAM, is conducting market research to identify qualified sources capable of providing enterprise AI Engineering Services in support of the Directorate of Technology, Innovation, and Engineering (TIE).

THIS IS A SOURCES SOUGHT / RFI ONLY. This notice does not constitute a solicitation, Request for Proposal (RFP), or Request for Quote (RFQ). No award will be made from this notice. Responses are strictly voluntary, will not be returned, and the Government will not pay for information provided. Do not submit proprietary information.

Submission of a response does not guarantee participation in any subsequent solicitation.

Background DOL is a nationwide Cabinet-level organization with Regional, District, Field, and headquarters offices supporting a broad mission across workers, employers, job seekers, and benefit recipients.

OCIO serves as DOL’s enterprise information technology (IT) organization; within OCIO, TIE leads emerging technology adoption including AI and Machine Learning (ML) to improve service delivery, automate processes, and strengthen data-driven decision-making.

DOL programs manage large volumes of structured and unstructured information — including regulatory documents, case files, program records, and operational data — creating opportunities for AI-enabled automation, search, analysis, summarization, and decision support across the Department’s major operating agencies (Occupational Safety and Health Administration (OSHA), Wage and Hour Division (WHD), Employment and Training Administration (ETA), Employee Benefits Security Administration (EBSA), Bureau of Labor Statistics (BLS), and others).

Program Context: New Program Start This is a new AI engineering program with no incumbent contractor. There is no existing contract in place for enterprise AI engineering services of this scope at DOL OCIO. The anticipated contractor will establish the program from a cold start, conducting discovery of DOL’s existing AI landscape, data sources, and technical environment through Government-Furnished Information (GFI) provided at contract start. Respondents should assess their cold-start mobilization capability accordingly.

Requirement Overview DOL anticipates a requirement for performance-based AI engineering, development, operations, governance, and support services covering the full lifecycle of AI systems across the Department. All capability areas below are mandatory requirements not a menu of options.

Primary AI Engineering Capabilities Required:

· Large Language Model (LLM) Integration and Production Deployment within the Federal Risk and Authorization Management Program (FedRAMP)-authorized cloud environments using FedRAMP-authorized cloud AI services (e.g., Amazon Web Services (AWS) Bedrock, Azure OpenAI Service, Google Cloud Platform (GCP) Vertex AI) and leading foundation models, subject to each model’s FedRAMP authorization status and DOL approval.

· Context Engineering the deliberate design and management of model context windows including token budgeting, memory architectures (short-term, long-term, episodic, semantic), context compression, dynamic context assembly, and structured output enforcement. This is the primary LLM competency required, distinct from prompt engineering.

· Retrieval-Augmented Generation (RAG) Pipeline Design and Optimization including standard RAG, Advanced RAG, hybrid dense/sparse retrieval, Graph Retrieval-Augmented Generation (GraphRAG) and knowledge graph-based retrieval (Neo4j or equivalent), multi-hop reasoning, and parent-child chunking for DOL’s environment.

· Agentic AI and Multi-Agent Orchestration including implementation of Model Context Protocol (MCP) to manage context flow, tool definitions, memory, and state across AI agents and services; orchestration using LangGraph, CrewAI, AutoGen, or equivalent frameworks.

· Multimodal AI Capabilities models and workflows involving text, images, audio, video, document layout models, and optical character recognition (OCR)/vision-based AI; multimodal pipelines with structured evaluation metrics, security controls, and privacy safeguards.

· Machine Learning Operations (MLOps) and Development, Security, and Operations (DevSecOps) including experiment tracking, model versioning, drift detection, automated retraining, and continuous integration/continuous delivery (CI/CD) integration for AI systems.

· Adversarial AI Security Testing integrated as an automated gate in CI/CD pipelines before every production release, including prompt injection scanning, jailbreak detection, perturbation testing, and data poisoning defense.

· Responsible AI Governance including Responsible AI Impact Assessments (RAIA) aligned to National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF) 1.0 and Office of Management and Budget (OMB) M-25-21 required quarterly (full assessment) and per production release (streamlined summary), with trigger-based RAIA when defined criteria are met.

· Human-in-the-Loop (HITL) Design for AI systems that inform or support consequential decisions affecting individual rights, benefits, employment, or enforcement actions.

· AI Incident Response aligned to a four-tier severity matrix (SEV-1 through SEV-4) with defined notification timelines; AI Incident Response Plan (AIRP) required within 30 days of award.

· FedRAMP Cloud AI Deployment at Federal Information Security Modernization Act (FISMA) Moderate baseline; all data at rest in contiguous United States (CONUS) data center regions; Federal Information Processing Standards (FIPS)-validated cryptography.

· AI-Specific Software Bill of Materials (SBOM) Production covering custom source code, third-party libraries, AI frameworks, model weights, embedding pipeline dependencies, and vector database versions; CycloneDX 1.4+ or Software Package Data Exchange (SPDX) 2.3+ format required.

· Full-Stack AI Application Development including Python/FastAPI backend and React/TypeScript front-end or equivalent with real-time LLM streaming interfaces (server-sent events (SSE)/WebSocket); Section 508 of the Rehabilitation Act of 1973, as amended / Web Content Accessibility Guidelines (WCAG) 2.1 A/AA compliant.

· Three-Environment AI Testing across DEV, TEST/STAGING, and PROD (canary, smoke, monitoring-based validation in live traffic); no direct DEV-to-PROD promotion.

· Knowledge Base Refresh Management per defined service level agreement (SLA) (monthly for regulatory/policy documents; immediate on material change triggers).

· Business Continuity and Continuity of Operations Plan (COOP) for AI systems including recovery time objectives (RTOs)/recovery point objectives (RPOs) per production AI system, failover procedures for RAG pipelines and vector databases, and annual tabletop testing per NIST Special Publication (SP) 800-34.

· AI Use-Case Inventory Support per OMB M-25-21 requirements; quarterly inventory updates for all AI systems under contract.

Secondary Supporting Capabilities:

· Data engineering and extract, transform, load (ETL)/extract, load, transform (ELT) pipeline development for AI workloads.

· AI governance program support including model cards, bias/fairness evaluation, explainability documentation.

· User Interface/User Experience (UI/UX) design including wireframing, prototyping, and Figma-based design with Section 508 compliance.

· AI Application Helpdesk (Tier 1/2/3 support with defined SLA coverage).

· Innovation and research assessments; proof-of-concept (POC) development.

· Agile project management (Jira, Confluence, sprint ceremonies).

· Transition-In (cold start; 45-day maximum) and Transition-Out support.

Innovation, Research, and Transition-to-Production Capability In addition to demonstrated production delivery experience, DOL seeks information on respondents’ capability to conduct AI innovation, technical research, prototyping, POC development, and feasibility assessments directly tied to enterprise implementation. The anticipated requirement may include evaluation of emerging AI technologies, experimentation in controlled environments, and transition of validated capabilities into secure, compliant production operations. Respondents should address both operational past performance and innovation/research and development (R&D) experience in their response (see Section 2O).

Mandatory Certifications: All Three Key Personnel Roles:

All three Key Personnel roles (Lead AI Engineer / Architect, Senior AI Engineer, and AI Project / Program Manager) shall each hold at least one current certification from the following acceptable list: Microsoft Azure AI/Applied Skills, AWS Generative AI/ML, Google Cloud Generative AI/ML, Databricks Generative AI Engineer, Snowflake SnowPro Advanced, NVIDIA Generative AI, Certified Artificial Intelligence Practitioner (CAIP), or equivalent. Credential IDs or verifiable badge URLs are required at proposal submission. The Government is also assessing whether certification expectations should apply to additional non-key labor categories; respondents shall address this in Section 3D and Section 5J.

Anticipated Contract Structure Contract Type: Labor Hour (LH)

PART II: REQUEST FOR INFORMATION

Response limit: 25 pages (Sections 2–5). Section 1 (Company Profile) does not count against the page limit. Submit in PDF or Microsoft Word. Organize responses by section and question number.

All capability areas in Section 2 reflect mandatory requirements in the anticipated solicitation.

Section 1: Company Profile (Does not count toward page limit)

· Company name, address, Unique Entity Identifier (UEI) number, Commercial and Government Entity (CAGE) code

· Business size under NAICS 541512; applicable socioeconomic category if small business

· General Services Administration (GSA) Multiple Award Schedule (MAS) schedule holder? Specify Special Item Number(s) (SIN(s))

· Current Government-Wide Acquisition Contract (GWAC) holder? (specify): _______________

· Active federal personnel security clearance level held by your organization

· Number of employees currently supporting federal AI/ML contracts

· Primary RFI point of contact: name, title, email, phone Section 2: Technical Capability Statement For each capability area, describe demonstrated experience with specific federal contract examples (contract number, agency, period of performance, approximate dollar value, brief description). If a capability area requires a teaming partner, identify the partner and describe the arrangement.

2A(i). LLM Integration and Production Deployment in FedRAMP Environments Describe your experience deploying LLMs in production federal environments within FedRAMP Moderate or higher authorized boundaries. Specify: LLMs deployed (GPT-4o, Claude, Llama, Mistral, Gemini, or other); FedRAMP-authorized platforms used; nature of production workloads; and any capability limitations encountered within FedRAMP authorization boundaries versus commercial equivalents.

2A(ii). LLM Fine-Tuning and Adaptation Within FedRAMP Boundaries The anticipated requirement may include model fine-tuning or adaptation when directed and approved by the Government. Describe whether your firm has performed LLM fine-tuning or parameter-efficient adaptation (e.g., supervised fine-tuning (SFT), Low-Rank Adaptation (LoRA), Quantized Low-Rank Adaptation (QLoRA), reinforcement learning from human feedback (RLHF)) within a FedRAMP Moderate or higher authorized environment. If yes, address: (a) the authorized platform(s) used; (b) which fine-tuning or adaptation techniques were available within the authorization boundary; (c) data-governance controls applied to training datasets, including personally identifiable information (PII)/Controlled Unclassified Information (CUI) handling, lineage, and access control; and (d) capability gaps between FedRAMP-authorized fine-tuning and commercial equivalents. If you have no production FedRAMP fine-tuning experience, describe your approach, known constraints, and the conditions under which fine-tuning would or would not be advisable in a FedRAMP environment.

2B. Context Engineering The anticipated requirement identifies context engineering as the primary LLM competency distinct from prompt engineering. Context engineering encompasses token budgeting, memory architectures (short-term, long-term, episodic, semantic), context compression and summarization, dynamic few-shot example selection, and structured output enforcement.

Describe your firm’s context engineering capabilities. Address: (a) token budgeting and context prioritization in production systems; (b) memory architecture patterns implemented (specify types deployed); (c) context compression techniques for long-running conversations or agentic tasks; (d) structured output enforcement tooling (Instructor, Outlines, Guidance AI, or equivalent); (e) how context engineering is operationally distinct from prompt engineering in your team’s workflow. Cite federal or enterprise examples. Responses describing only prompt engineering techniques will not be considered responsive.

2C(i). Standard and Advanced RAG Pipelines Describe your RAG pipeline implementation experience for document-heavy federal use cases. Specify: chunking strategies; embedding models; vector databases used (Pinecone, Weaviate, pgvector, Chroma, Qdrant, or other); hybrid dense/sparse retrieval; re-ranking; and retrieval evaluation metrics tracked (precision, recall, mean reciprocal rank (MRR), normalized discounted cumulative gain (NDCG), context relevance).

2C(ii). GraphRAG and Knowledge Graph Retrieval The anticipated requirement specifically includes GraphRAG and knowledge graph-based retrieval for DOL’s regulatory documents, case files, and program records. Standard RAG experience alone does not address this requirement.

Describe any production GraphRAG or knowledge graph retrieval implementations: (a) graph database technology used (Neo4j, Amazon Neptune, Cosmos DB for Gremlin, or other); (b) domain and use case — regulatory, legal, or government document environments are particularly relevant; (c) integration with vector similarity search in a hybrid architecture; (d) performance improvements versus standard RAG; (e) FedRAMP deployment challenges. If no production GraphRAG experience exists, describe your specific capability development approach and timeline.

2D. Model Context Protocol (MCP) and Agentic Orchestration MCP is being evaluated as a mandatory architectural standard for agentic AI systems under the anticipated contract.

Describe your MCP implementation experience, including: (a) number and nature of MCP deployments, including any Federal or enterprise production examples; (b) orchestration frameworks used with MCP (e.g., LangGraph, CrewAI, AutoGen, or equivalent); (c) how context flow, tool definitions, agent state persistence, and inter-agent coordination were managed across agent boundaries; (d) safety controls for agentic workflows, including loop termination safeguards, autonomy limits, HITL trigger points, tool-call governance, and escalation conditions; (e) metrics used to monitor MCP / agentic performance (e.g., tool-call success/failure rates, retry rates, loop termination events, latency, state consistency, override frequency); (f) FedRAMP deployment challenges and mitigations; and (g) current availability of MCP-experienced personnel. If no production MCP experience exists, describe your specific implementation approach, training path, and realistic timeline to production readiness.

2E. Multimodal AI Capabilities The anticipated requirement may include multimodal AI workflows involving text, images, audio, video, document layout models, and OCR/vision-based AI when directed by the Government.

Describe your multimodal AI experience, including: (a) which modalities you have deployed in production; (b) relevant Federal or enterprise examples; (c) evaluation metrics used for multimodal outputs; (d) security and privacy controls applied to multimodal pipelines, including handling of PII/CUI in images, documents, audio, or video; (e) accessibility validation and user experience considerations for multimodal applications, including compliance with Section 508 and WCAG 2.1 A/AA where user-facing components were involved; (f) whether you have produced Accessibility Conformance Reports (ACRs), Voluntary Product Accessibility Templates (VPATs), or equivalent accessibility evidence for AI-enabled interfaces; and (g) FedRAMP-authorized multimodal AI services used or evaluated. If multimodal experience is limited, identify which modalities are currently deliverable and which would require additional capability development.

2F(i). AI-Specific Security Controls Describe your AI security controls in production federal environments covering: (a) prompt injection prevention (input validation, output filtering, layered safety controls); (b) model inversion and extraction defense; (c) data poisoning detection (dataset lineage, ingestion anomaly detection); (d) PII/CUI masking across pipeline layers (RAG ingestion, training data, embeddings, model outputs); and (e) secure LLM application programming interface (API)/secret management in FedRAMP-approved vaults. Identify specific tooling for each category.

2F(ii). Adversarial AI Testing in CI/CD Pipelines The anticipated requirement mandates adversarial AI testing as an automated gate before every production promotion — not as a periodic assessment.

Describe your automated adversarial testing capability: (a) tooling used for automated adversarial testing in CI/CD pipelines (NeMo Guardrails, LlamaGuard, Guardrails AI, custom harnesses, or equivalent); (b) typical runtime overhead per release and compatibility with a two-week sprint cadence; (c) finding triage process — what threshold triggers a release block; (d) how adversarial test suites are maintained as attack techniques evolve; (e) production examples of adversarial CI/CD gates on federal or enterprise contracts.

2G. AI Incident Response The anticipated requirement includes a four-tier AI Incident Response Severity Matrix and requires an AIRP within 30 days of award.

Describe your AI incident response capability, including: (a) experience with AI-specific incident classification and tiered response; (b) AIRP structure or template, including escalation contacts, evidence preservation procedures, communications, containment, mitigation, and post-incident review; (c) tooling and methods used for evidence preservation, including session logs, prompts, outputs, retrieval context, model/version IDs, embeddings or index state, and relevant system telemetry; (d) experience reporting AI or cyber incidents to Federal Computer Security Incident Response Teams (CSIRTs) or equivalent organizational incident response functions within required timelines; (e) experience producing sanitized incident briefs, root-cause summaries, or post-incident artifacts for governance or executive review; and (f) approach to delivering an initial AIRP within 30 days of award. Do not submit sensitive or proprietary incident data; sanitized examples or narrative summaries are sufficient.

2H. Responsible AI, RAIA, and Governance Operations The anticipated requirement includes RAIAs, recurring governance reviews, model documentation, and related operational governance artifacts.

Describe your Responsible AI implementation experience, including: (a) NIST AI RMF-aligned RAIA experience across GOVERN, MAP, MEASURE, and MANAGE functions; (b) experience operating a two-tier RAIA process, including periodic full assessments and release-specific or change-specific summaries; (c) experience identifying and responding to RAIA trigger conditions, such as consequential decision support, PII/CUI use, generative outputs without mandatory human review, high-impact designation, or significant system change; (d) model governance practices, including development and maintenance of model cards documenting intended use, limitations, data sources, evaluation results, fairness considerations, and appropriate use boundaries; (e) governance dashboards, status reporting, recurring governance reviews, and tracking of findings, mitigations, and approvals; (f) tooling used for bias detection, fairness evaluation, explainability, and impact analysis; and (g) how RAIA and governance findings were integrated into system design, controls, HITL design, release decisions, and operational monitoring.

2I. Human-in-the-Loop (HITL) Design For AI systems affecting individual rights, benefits, employment, or enforcement actions, documented HITL controls are required including: defined human review step before consequential actions; override/reject/escalate mechanism with documented rationale; audit logging of AI outputs, human decisions, and overrides; and UI design distinguishing AI-generated from human-verified content.

Describe your HITL design experience: (a) prior federal AI programs where you implemented HITL controls for consequential decision systems; (b) specific technical approaches for override mechanisms and audit logging; (c) UI design patterns for distinguishing AI-generated from human-verified content; (d) how HITL controls were validated in RAIA cycles.

2J. Business Continuity and COOP for AI Systems The anticipated requirement includes a Business Continuity Plan (BCP) for all production AI systems per NIST SP 800-34, with RTOs/RPOs per system, failover procedures for AI model serving endpoints, RAG pipelines, and vector databases, and annual tabletop testing.

Describe your BCP/COOP experience for AI systems: (a) prior experience developing and testing BCPs for AI model serving, RAG pipelines, or vector database infrastructure; (b) RTO/RPO examples from prior programs and how they were achieved; (c) failover architecture for AI inference endpoints and knowledge bases; (d) tabletop testing experience for AI-specific recovery scenarios.

2J(i). Transition-Out, Artifact Transfer, and Media Sanitization Describe your experience supporting orderly transition-out for AI or software-intensive programs, including: (a) transfer of source code, prompts, model artifacts, embeddings, pipeline definitions, runbooks, test artifacts, configurations, and documentation to Government or successor teams; (b) maintenance of Government-accessible repositories during performance; (c) knowledge transfer methods for architecture, operations, governance, and support procedures; (d) media sanitization or cloud deletion practices aligned to NIST SP 800-88 or equivalent standards; and (e) controls used to ensure no loss of Government rights, continuity, or access at closeout or transition.

2K. AI-Specific SBOM Production The anticipated requirement mandates SBOMs covering custom source code, third-party libraries, AI frameworks, model weights, embedding pipeline dependencies, and vector database versions per National Telecommunications and Information Administration (NTIA) minimum elements in CycloneDX 1.4+ or SPDX 2.3+ format, required per production release and updated per retraining cycle.

Describe your AI-specific SBOM capabilities: (a) current tooling for SBOM generation including AI model artifacts (Syft, Grype, CycloneDX tools, or equivalent); (b) experience extending NTIA minimum elements to model weights and AI framework dependencies; (c) limitations encountered applying standard SBOM tooling to AI artifacts; (d) SBOM update process across retraining cycles. If AI artifact SBOM capability does not yet exist, describe your development approach.

2L. Three-Environment AI Testing with PROD Validation The anticipated requirement mandates promotion controls (no DEV-to-PROD promotion), automated security and test, evaluation, validation, and verification (TEVV) gates for STAGING promotion, and PROD validation including canary testing, smoke testing, and monitoring-based model evaluation in live traffic.

Describe your three-environment AI testing experience: (a) production (PROD) AI model validation tooling (LangSmith, Arize AI, Evidently AI, Grafana, or equivalent); (b) canary or shadow deployment approach for AI model updates; (c) hallucination and retrieval failure detection in live production traffic; (d) production AI model service level objectives (SLOs) defined and managed on prior contracts.

2M. Knowledge Base Refresh Management The anticipated requirement includes a codified Knowledge Base Refresh SLA: monthly for regulatory/policy documents; immediate refresh on material change triggers; with escalation to the Contracting Officer’s Representative (COR) when post-refresh retrieval relevance scores decline more than 5%.

Describe your knowledge base refresh management approach: (a) embedding refresh workflow automation tooling; (b) relevance score monitoring before and after refresh; (c) process for detecting and escalating post-refresh relevance degradation; (d) prior examples of maintaining large-scale RAG knowledge bases under defined refresh SLAs.

2N. Security, Privacy, Accessibility, and Compliance All AI systems under the anticipated contract must operate within a FISMA Moderate baseline and FedRAMP-authorized boundaries, with full Authority to Operate (ATO) lifecycle support, privacy protections, and Section 508 accessibility conformance.

Describe your experience implementing and maintaining security, privacy, and compliance controls for AI or IT systems in Federal environments, including: (a) FISMA Moderate operations and implementation of NIST SP 800-53 (Moderate baseline) and, for contractor-owned systems, NIST SP 800-171 controls; (b) operating AI or application workloads within FedRAMP Moderate (or higher) authorized cloud boundaries, including data-residency/CONUS and FIPS-validated cryptography controls applied; (c) ATO lifecycle support under the NIST Risk Management Framework (RMF) (SP 800-37), including System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), Privacy Threshold Analysis (PTA), and Privacy Impact Assessment (PIA) development; (d) experience obtaining or supporting initial ATOs and Interim Authorities to Operate (IATOs), including typical timelines achieved; (e) privacy and data-protection practices for PII and CUI, including handling, minimization, masking/redaction, access control, and Privacy Act compliance; (f) Section 508 / WCAG 2.1 A/AA validation methodology (Department of Homeland Security (DHS) Trusted Tester or equivalent), remediation workflow, and production of ACR/VPAT for AI-enabled interfaces; and (g) continuous monitoring for AI systems, including control-drift detection and audit-ready documentation. Cite Federal or enterprise examples and identify specific tooling where applicable.

2O. Past Performance, Innovation, and R&D Experience The Government seeks information regarding respondents’ demonstrated record of successful performance in delivering AI engineering services of similar scope, complexity, and regulatory environment, including both operational production work and innovation/research activities that informed production adoption.

Number and type of examples. Respondents shall provide up to five (5) examples total, including at least three (3) production, development, or operations examples. Respondents may substitute up to two (2) innovation/R&D examples within the five-example total.

Acceptable examples include: prior or current contract performance for AI/ML, generative AI, RAG, agentic AI, multimodal AI, MLOps, AI governance, AI security, or related enterprise AI engineering services; and innovation, research, experimentation, pilot, prototype, or POC efforts relevant to the anticipated requirement that demonstrate capability maturation, technical feasibility assessment, transition-to-production readiness, or measurable mission/business value.

Recency. Examples should reflect performance within the last three (3) years. Older examples may be included only if the technical approach remains current and relevant to the anticipated requirement.

Source environments. Examples may come from Federal, State, local, Federally Funded Research and Development Center (FFRDC), university-affiliated, or commercial environments. Federal examples are preferred, particularly those involving FISMA Moderate, FedRAMP-authorized cloud services, CUI/PII handling, Section 508 compliance, AI governance, or enterprise production operations.

Releasability. Respondents shall provide only information they are authorized to release. Do not submit proprietary, trade-secret, or competition-sensitive information. Dollar values may be provided as ranges. Customer points of contact should be provided only with the individual’s awareness or marked “available upon request.”

For each example, provide:

· Customer / Agency / Organization name

· Contract, task order, Blanket Purchase Agreement (BPA)/call/order, or other agreement identifier, if applicable

· Period of performance

· Approximate dollar value of the AI/ML-related effort (not total indefinite-delivery, indefinite-quantity (IDIQ) ceiling); ranges acceptable

· Type of effort (select all that apply): Production operations and maintenance (O&M); New development / modernization; Innovation / R&D; Pilot / prototype / POC; Advisory / assessment directly tied to AI implementation

· Brief scope description, identifying the relevant AI capability areas addressed (e.g., LLM integration, context engineering, RAG / Advanced RAG / GraphRAG, MCP, agentic AI / orchestration, multimodal AI, MLOps / DevSecOps, adversarial testing, Responsible AI / RAIA, HITL design, AI incident response, SBOM generation, AI operations / helpdesk / production monitoring)

· Your company’s role (prime, subcontractor, original equipment manufacturer (OEM)/provider, research partner, or innovation lead)

· Relevant technical environment, including FedRAMP boundary, cloud platform, model providers, data sensitivity, and deployment maturity (POC / pilot / limited production / full production)

· Outcomes / results achieved, including measurable technical or mission outcomes where available (e.g., retrieval relevance improvement, latency reduction, reduced manual workload, increased user adoption, decreased hallucination rate, successful production deployment, ATO support, governance maturity improvement)

· Transition-to-production evidence, where applicable, describing whether and how the work moved from research/pilot/POC into operational use

· Quality / performance indicators (e.g., Contractor Performance Assessment Reporting System (CPARS) ratings where applicable for Federal efforts; for non-Federal efforts, customer assessments, acceptance results, milestone completion, SLA achievement, or other objective evidence)

· Customer point of contact (name, title, email, phone), if available and releasable Innovation/R&D efforts that did not transition to production. Where an innovation, research, prototype, or POC effort did not reach production, respondents shall briefly explain: the purpose of the effort; the technical or programmatic insight gained; the constraints that prevented production deployment; and why the effort remains relevant to this requirement.

Areas of specific Government interest. The Government is interested not only in past delivery of comparable services, but also in respondents’ ability to evaluate emerging AI technologies, mature capabilities responsibly, and transition promising innovations into secure, compliant, production-ready enterprise solutions.

Format. Each example shall not exceed 1.5 pages.

Section 3: Key Personnel Availability and Talent Strategy 3A. Does your firm currently employ personnel meeting minimum qualifications for all three key personnel roles (Lead AI Engineer/Architect, Senior AI Engineer, AI Project/Program Manager)? For any role where your firm would require new hires or subcontractor personnel, identify the role and describe the gap.

3B. Can your firm commit to having all three Key Personnel onboarded and operationally functional within 15 calendar days of contract award, including initiation of Personal Identity Verification (PIV) badge processing, DOL network access provisioning actions, multi-factor authentication (MFA) enrollment, and mandatory security training completion, and to having the full workforce operational with required access provisioned within 45 calendar days? This reflects the anticipated Transition-In milestones. Identify the primary constraints and your specific mitigation strategies.

3C. Describe your firm’s AI talent retention strategy for the Washington, DC market. Specifically address retention risk for Lead AI Architect, Senior AI Engineer, and MCP/context engineering specialists over a 42-month contract period.

3D. Identify which of the certifications listed below are currently held by personnel in your proposed key personnel pool and broader staffing pool, by labor category. Specific individual names are not required at this stage; however, respondents shall identify the number of currently available personnel in each labor category holding each applicable certification.

For purposes of market research, DOL is considering certification expectations by labor category as follows:

Key Personnel Lead AI Engineer / Architect Must hold at least one (1) current certification from the following list:

· Microsoft Azure AI / Applied Skills / Azure AI Engineer-related credential

· AWS Generative AI or AWS Machine Learning certification

· Google Cloud Generative AI or Machine Learning certification

· Databricks Generative AI Engineer certification

· Snowflake SnowPro Advanced (Data Engineer or Data Scientist) or equivalent relevant Snowflake certification

· NVIDIA Generative AI certification

· CAIP or equivalent Senior AI Engineer Must hold at least one (1) current certification from the same acceptable list above.

AI Project / Program Manager Must hold: at least one (1) current certification from the acceptable AI certification list above; and project/program management certification such as Project Management Professional (PMP), Scaled Agile Framework (SAFe), or equivalent is preferred.

Non-Key Labor Categories AI Engineer / Developer Preferred to hold at least one (1) current AI/cloud certification relevant to generative AI, ML, or AI engineering from the acceptable list above.

ML Engineer Preferred to hold at least one (1) current AI/ML certification from the acceptable list above; certifications focused on ML engineering, MLOps, model lifecycle management, or cloud AI/ML services are particularly relevant.

Data Engineer Preferred to hold at least one (1) current certification relevant to AI data platforms, data engineering for AI/ML workloads, or cloud-based data/ML services, including acceptable certifications from the list above where applicable.

UI/UX Designer No mandatory AI certification is currently contemplated; however, respondents should identify personnel with relevant credentials or training in: accessible design; Section 508 / WCAG conformance; human-centered design for AI-enabled systems; and HITL / AI decision-support interfaces, if available.

Respondents shall indicate for each labor category: which certifications are currently held by available personnel; how many personnel in that category currently hold qualifying certifications; whether the certification is held by in-house personnel or would be provided through a teaming partner/subcontractor; and any labor categories for which the contemplated certification expectation would materially constrain competition or reduce availability of qualified personnel in the Washington, DC market.

Credential IDs or verifiable badge URLs are not required in the RFI response unless the respondent elects to provide them, but respondents should state whether such verification documentation is available upon request.

3E. This contract requires non-key personnel in four additional labor categories (AI Engineer/Developer, ML Engineer, Data Engineer, UI/UX Designer). What is your current bench strength in these categories for a program of this scope, and how do you plan to staff these roles within the 45-day Transition-In period? Respondents may also identify additional labor categories they believe are operationally necessary for successful performance, such as MLOps Engineer, AI Security Engineer, Knowledge Engineer, or equivalent specialized roles, and explain whether those capabilities can be covered within the draft labor category structure or require separate labor categories.

Section 4: Acquisition Vehicle, Teaming, and Ordering 4A. What acquisition vehicle do you recommend and why, considering: AI-capable vendor pool depth; ordering speed; and ordering process efficiency? Address: GSA MAS (54151S, 541511), National Institutes of Health (NIH) Chief Information Officer — Solutions and Partners 3 (CIO-SP3), National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement VI (SEWP VI), GSA Alliant 3, GSA 8(a) Streamlined Technology Acquisition Resource for Services III (STARS III), or open market.

4B. Based on your direct GWAC ordering experience, what is a realistic timeline from solicitation release to contract award for a requirement of this technical complexity? What factors most significantly affect ordering timelines on your recommended vehicle?

4C. Do you anticipate teaming arrangements? If yes, identify specifically which capability areas in Section 2 would be addressed by a teaming partner and estimate the percentage of total contract hours that capability represents. Also describe how your firm would flow down and monitor compliance with contract requirements applicable to subcontractors, including security, privacy, CUI/PII handling, Responsible AI / RAIA, accessibility, and non-disclosure obligations.

4D Small Business Respondents: Is the full scope achievable by a small business prime independently or through teaming? For each Section 2 capability area where you would rely on a large-business subcontractor, identify the area, estimated percentage of contract hours, and whether an existing teaming relationship is in place.

4E Other-Than-Small Business Respondents: What percentage of total estimated contract value could realistically be subcontracted to small businesses, and in which capability areas?

Section 5: Industry Feedback on Draft Requirement DOL specifically requests candid feedback on the following. Responses will directly inform Performance Work Statement (PWS) refinement and acquisition strategy. Honest feasibility assessments will not prejudice your firm’s participation in any subsequent competition.

5A. Cold-Start Transition-In The program is a new start with no incumbent. The Government contemplates Key Personnel onboarded and operationally functional by Day 15 and the full workforce operational with required access provisioned by Day 45. Transition-In focuses on discovery from GFI rather than incumbent knowledge transfer. (a) Is this timeline realistic for an AI engineering program of this technical depth? (b) What Government actions would most effectively support the Day 15 and Day 45 milestones (e.g., pre-award vetting, rapid PIV scheduling, quality of GFI package, pre-provisioned environments, advance model/service approvals)? (c) What are the most likely causes of schedule slippage during cold start?

5B. PWS Scope Currency Based on the capability areas described in this RFI, are there AI technologies, approaches, tools, or standards referenced that are overly prescriptive, technically outdated, insufficiently mature in Federal environments, or incompatible with FedRAMP constraints as of the anticipated performance period? Where named products or frameworks are referenced, should they be reframed as examples only with “or equivalent” language? Are there significant capability areas absent from the scope?

5C. MCP Maturity in Federal AI MCP is identified as a mandatory architectural standard for agentic AI systems. (a) How mature is MCP production adoption among federal AI contractors as of mid-2026? (b) Are there practical implementation challenges with MCP in FedRAMP-authorized environments? (c) Are there complementary or alternative agentic orchestration standards that should be considered alongside MCP?

5D. Multimodal AI in FedRAMP

(a) Which multimodal AI services are currently available within FedRAMP Moderate authorization on AWS, Azure, or GCP? (b) What are the most significant constraints on multimodal AI within FedRAMP boundaries? (c) Are graphics processing unit (GPU)/accelerator resources for multimodal AI workloads adequately provisioned through standard GovCloud offerings?

5E. RAIA Implementation at Scale

(a) Is this governance structure operationally feasible within a two-week sprint cadence? (b) What staffing, tooling, and timeline does a full NIST AI RMF-aligned RAIA require for a program of this scope? (c) What process structures would allow release-specific RAIA summaries, model card maintenance, and governance reporting to occur without unduly slowing release velocity? (d) Which elements are best automated versus manually reviewed?

5F. AI-Specific SBOM Feasibility

(a) Is established tooling available for NTIA-aligned SBOM generation covering AI artifacts? (b) What gaps exist between current SBOM tooling and practical AI artifact coverage? (c) Is per-release and per-retraining-cycle SBOM production operationally feasible with current tooling? (d) What implementation approach would you recommend?

5G. Business Continuity for AI Systems

(a) What RTOs/RPOs are realistically achievable for AI model serving endpoints, RAG pipelines, and vector databases in a FedRAMP GovCloud environment? (b) What are the most significant recovery challenges for AI-specific infrastructure (model serving, embeddings, vector databases) not present in traditional IT BCP?

5H. Context Engineering and Labor Market

(a) Does the AI labor market currently differentiate context engineering as a distinct job function or competency? (b) Are the three key personnel roles and four supporting labor categories sufficient to cover the full scope, or are there roles (e.g., dedicated MLOps Engineer, AI Security Engineer, Knowledge Engineer) that should be added? (c) Are there minimum qualification requirements that would materially restrict your qualified candidate pool?

5I. Pricing and Staffing

(a) What staffing mix and total full-time equivalent (FTE) level do you believe is necessary for successful performance of all 39 deliverables across contract line item numbers (CLINs)? (b) Are fully-loaded federal AI engineering labor rates for the seven CLIN 0001 categories in the DC market consistent with retaining qualified personnel over 42 months? (c) What is your assessment of the other direct costs (ODC) CLIN scope — are there recurring cost categories the Government should anticipate that are not covered by Government-furnished compute?

5J. Certification Feasibility and Labor Market Impact

(a) Is it reasonable to require at least one acceptable AI certification for all three key personnel roles (Lead AI Engineer / Architect, Senior AI Engineer, and AI Project / Program Manager)? (b) For non-key labor categories (AI Engineer / Developer, ML Engineer, Data Engineer), should AI/cloud certifications be mandatory, preferred, or evaluated but not required? (c) Are there labor categories for which certification requirements would unnecessarily restrict competition without improving performance outcomes? (d) Are the acceptable certification families listed in this RFI appropriately aligned to the anticipated work, including FedRAMP cloud AI deployment, RAG, MCP, MLOps, and enterprise AI engineering? (e) Should accessibility or human-centered AI credentials be identified for the UI/UX Designer labor category, and if so, which ones?

5K. ATO Timeline Feasibility (Cold Start)

(a) For a cold-start enterprise AI program of this scope, what is a realistic timeline from award to first production ATO or Interim Authority to Operate (IATO)? (b) What Government actions (pre-defined security boundary, governance, risk, and compliance (GRC) tool access, early authorizing-official engagement, FedRAMP inheritance reuse) would most accelerate the initial ATO? (c) What are the most common causes of ATO schedule slippage for AI systems, and how would you mitigate them?

5L. Service Contract Act Applicability The anticipated labor categories are predominantly professional AI engineering roles, with some tiered helpdesk and support functions. (a) In your assessment, are any of the anticipated labor categories likely subject to the Service Contract Act (SCA)? (b) If so, which categories, and what Wage Determination (WD) considerations should the Government anticipate?

PART III: SUBMISSION INSTRUCTIONS

Deadline: July 8, 2026, at 4:00 PM Eastern Time Method: Email to Albracht.Kyle.K@dol.gov with subject line: "RFI Response - DOL OCIO AI Engineering Services - [Company Name]" Format:

· PDF or Microsoft Word

· Maximum 25 pages (Sections 2–5 combined)

· Section 1 (Company Profile) does not count toward page limit

· Font: Times New Roman or Arial, 11-point minimum, 1-inch margins

· Organize by section and question number as labeled Questions: Written questions may be submitted by 10:00AM ET on July 6, 2026, via email to Albracht.Kyle.k@dol.gov with subject line "RFI Questions - DOL OCIO AI Engineering Services". Questions will be used for market research purposes only.

PART IV: IMPORTANT NOTICES

· No Solicitation. This RFI does not obligate the Government to issue a solicitation, make an award, or pay for information provided. Issued solely for market research per FAR Part 10.

· No Proprietary Information. Do not include proprietary, trade secret, or classified information. The Government accepts no responsibility for inadvertently submitted proprietary data.

· No Feedback. The Government will not provide feedback on individual RFI responses.

· No Commitment. Submission does not guarantee participation in any future solicitation or that a solicitation will be issued.

· SAM.gov Registration Required. Firms seeking future award must be registered and active at www.sam.gov prior to award.

· Small Business Encouraged. DOL strongly encourages small business responses of all socioeconomic categories. Responses to Section 4D are critical to the Government's set-aside determination.

· Contractor Identification. All contractor personnel communicating with Government personnel must identify themselves as contractors per FAR requirements.

· Service Contract Act. This RFI is issued in connection with an anticipated acquisition that may be subject to the Service Contract Act (SCA) (41 U.S.C. §6701 et seq.). The applicability of the SCA, and any associated Wage Determination, is under review. Respondents are invited to address SCA applicability to the anticipated labor categories in their Section 5 feedback.

· No Oral Presentations. Responses must be in writing. Individual meetings will not be granted in connection with this RFI.