Product Description - iRIS DRAFT.docx

iMedRIS Integrated Research Information System (iRIS) Software/Maintenance Renewal TAC Number: VA-26-00065187

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) End User Operations (EUO) iMedRIS Integrated Research Information System (iRIS) Software/Maintenance Renewal

Date: May 15, 2026

VA-26-00065187

PD Version Number: 1.1

Contents

PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA) Office of Information and Technology (OIT) End User Operations (EUO) requires renewal of licensing, maintenance, and support for the iMedRIS Integrated Research Information System (iRIS) currently deployed at multiple VA sites. iRIS is a VA‑approved, modular research compliance platform supporting the Institutional Review Board (IRB), Institutional Animal Care and Use Committee (IACUC), Subcommittee on Research Safety and Security/Institutional Biosafety Committee (SRSS/IBC), Research and Development Committee (RDC), and the Veterinary Medical Unit (VMU). The system facilitates centralized document management, electronic routing, automated notifications, reporting, and regulatory oversight activities required by VA research governance and federal compliance bodies.

This requirement ensures continued operational availability of the system through routine and corrective maintenance, including software updates, bug fixes, security patches, version upgrades, and configuration support. The contractor shall provide functional and technical assistance for issues affecting workflow processing, committee operations, and integrations such as the CITI training interface. Maintenance services are required to sustain cybersecurity compliance, preserve data integrity, and maintain interoperability with VA enterprise services, including authentication, role‑based access controls, and audit logging.

The continued support for iRIS is essential to ensure uninterrupted processing of research protocols, committee reviews, safety assessments, and associated oversight functions. The system has been in use within VA since 2012 and incorporates extensive local workflow configurations designed to align with VA research processes and compliance needs. Ongoing support allows VA sites to retain these efficiencies, prevent delays in research review cycles, and maintain adherence to human subjects protections, biosafety requirements, animal welfare standards, and VA Office of Research & Development policy.

Performance shall be a 12-month base period with four 12-month option periods.

iMedRIS Software Maintenance Support Agreement Software Rental and License-T4GCZAB55

1 YR

SOFTWARE SUPPORT

The contractor shall provide technical support for all subscriptions purchased. All technical support will be provided 24 hours a day, 7 days a week, 365 days a year, to include access to Clarivate online and phone support. All technical support will include but not be limited to major product and technology releases, technical support, updates, fixes, security alerts, data fixes, and critical patch updates, upgrade scripts, tax, legal, and regulatory updates and certification with most existing third-party products/versions.

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING SUSTAINABLE PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) to provide ENERGY STAR® certified and Federal Energy Management Program (FEMP) Designated Low Standby Power information technology products, see https://www.energy.gov/femp/search-energy-efficient-products. See http://www.energystar.gov for complete product specifications and updated lists of Energy Star certified products. FEMP low standby power product listing can be found at https://www.energy.gov/femp/low-standby-power-product-list.

The Contractor shall provide products that meet the definition of sustainable products if the products are delivered to the Government; furnished by the Contractor for use by the Government, incorporated into the construction of a public building or public work, or acquired by the Contractor for use in performing services under a Government contract where the cost of the products is a direct cost to a Government contract (versus costs which are normally applied to a contractor's general and administrative expenses or indirect costs).

Specifically, the Contractor shall provide sustainable products under this contract in accordance with RFO 52.223-23 (NOV 2025). The applicable products with their associated certification and/or designation required (e.g. Energy Star, FEMP Low Standby Power) are identified within the product requirements specifications in this PD. The Contractor shall self-certify that its proposed products meet the certification(s) and/or designation(s) specified.

SHIPMENT OF HARDWARE OR EQUIPMENT

All items listed in Section 1 as part of this Order shall be delivered electronically to the primary and alternate points of contact identified below.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Address:

Address:

Voice:

Voice:

Email:

Email:

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents.)

GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

If Artificial Intelligence (AI) is part of the Contractor system/solution, the Contractor shall be in compliance with E.O. 13960 and 14319, OMB Memorandums M-25-21, M-25-22, and M-26-04, and VA Directive and Handbook 6500 to support VA in trustworthy, secure, responsible, accountable, Truth Seeking, and Ideologically Neutral AI innovation.

No web-based, publicly available generative AI service has been approved for use with VA-sensitive data including, but not limited to OpenAI’s ChatGPT, Microsoft’s Copilot, Google’s Gemini, and Anthropic’s Claude. No PII, protected health information (PHI), or VA-sensitive data should be entered into these unapproved services. The entire definition of VA Sensitive Data can be found at 38 U.S.C. § 5727 (23). The Contractor shall protect VA Sensitive data from unauthorized disclosure or use, and from being used to train or improve the functionality of the vendor's commercial offerings without express permission from VA. Only VA-hosted instances of generative AI services may be approved for use with VA-sensitive data.

The Contractor shall deliver the services, technical data, configurations, models, weights, documentation or other information, including source code, developed during contract performance. The Contractor, in collaboration with VA, must evaluate the output of any AI tool for accuracy prior to using the output in VA efforts. All data, including models, weights, algorithms, and outputs generated using either Government-furnished data or data first developed under this contract shall be the property of the Government with unlimited rights as defined by FAR 52.227-14. The Contractor shall also deliver any custom-developed code developed with AI methodologies in accordance with the SHARE IT Act, if applicable. VA shall also retain unlimited rights to any improvements to that data, including the continued design, development, testing, and operation of AI systems and/or systems utilizing AI.

The Contractor shall ensure that all AI Systems, including Large Language Models (LLM), whether standalone LLMs or integrated into broader software platforms, procured under this effort and/or used in performance of this contract complies with the Unbiased AI Principles as defined in Executive Order 14319 and OMB Memorandum M-26-04, e.g. Truth Seeking and Ideologically Neutral, as applicable to the intended use of the system.

The Contractor shall ensure that AI System/LLM generated outputs are truthful in responding to user prompts seeking factual information or analysis, prioritize historical accuracy, scientific inquiry, and objectivity, as well as acknowledge uncertainty where reliable information is incomplete or contradictory and do not fabricate, hallucinate, or present unverifiable information as fact.

The Contractor shall ensure that LLMs and AI outputs are neutral, nonpartisan tools that do not manipulate responses in favor of ideological dogmas such as Diversity, Equity, and Inclusion (DEI). The Contractor shall ensure that the LLMs, including the AI System, are not intentionally encoded with partisan or ideological judgments within an AI System’s/LLM’s outputs unless those judgments are prompted by or otherwise readily accessible to the end user.

Compliance with the AI requirements of this contract, including adherence to the Unbiased AI Principles, Truth-Seeking and Ideological Neutrality requirements, disclosure obligations, monitoring and reporting requirements, and corrective action responsibilities, is a material condition of eligibility for payment and continued performance. In accordance with OMB Memorandum M-26-04, failure to comply with these requirements, or refusal to take timely and appropriate corrective action to remedy identified noncompliance, may constitute a material breach of contract and may result in remedies consistent with the terms of the contract and applicable law including but not limited to withholding of payment, termination for cause/default, or other appropriate contractual remedies, as determined by the Contracting Officer.

All AI for delivery and/or use in performance of the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation as identified in the Artificial Intelligence in VA Contracts clause, to include its associated list of AI being used in contract performance.

Deliverable:

1. Statement of Attestation

AI SYSTEM/LLM DEVELOPMENT AND OPERATION DOCUMENTATION REQUIREMENTS

To enable Government continued assessment of compliance with Trustworthy AI requirements and both Unbiased AI Principles, Truth-seeking and Ideological Neutrality, in accordance with OMB M-26-04, the Contractor shall provide AI System/LLM Development and Operation Documentation Package to include, at a minimum:

1. Acceptable Use Policy The Contractor shall provide an Acceptable Use Policy document governing its AI operation that characterizes and differentiates appropriate and inappropriate use of their product offering

1. Model Cards, System Cards and/or Data Cards The Contractor shall provide documentation describing essential information about the model, system, and or data as it relates to the AI/LLM product offering. The documentation shall address summaries of training process, identified risks and mitigations, and model evaluation scores on LLM benchmarks at a minimum, where appropriate

1. End User Resources The Contractor shall provide documentation to include product tutorials, developer guides, and/or other tools to assist VA in ensuring proper use of the AI/LLM to maximize utility

1. Mechanism for End User Feedback The Contractor shall provide documentation describing the mechanism employed to provide feedback to the Offeror on outputs identified that violate the Unbiased AI Principles. This may be satisfied by a general inbox, specific Point of Contact, or similar feedback mechanism.

1. Pre-Training and Post-Training Activities of the AI System/LLM The Contractor shall provide documentation of Pre-Training and Post Training Activity that provides details on:

4. Actions taken that impact the factuality and grounding of AI System/LLM outputs

4. System-level prompts that provide natural language instructions to the model specifying guidelines on responding to user-generated queries, to include how a model responds when reliable information is incomplete, contradictory, or subject to individual interpretation

4. The type of outputs restricted via content moderation and safety filters

4. The use of red teaming as a means of continuously assessing the model to protect against incidents of bias in generated output.

4. Training or development, if any, that occurred outside the United States, to include the type of activity and the country in which it occurred.

4. Any modifications or configurations undertaken to comply with any regulation from a government other than the U.S. Federal Government.

1. Model Evaluation Results and Methodologies The Contractor shall provide documentation describing the Evaluation Results of bias evaluations conducted by the Vendor to include the methodology for performing such tests (e.g., testing prompt pairs for politically oriented topics).

The documentation shall also include Benchmark scoring results measuring the model’s bias, helpfulness, honesty, or accuracy when provided with ambiguous versus straightforward questions. (Including any benchmarks comparing performance across multiple languages, where applicable).

1. Description of Enterprise-Level Controls The Contractor shall provide documentation describing the Enterprise Governance tools and controls, such as:

6. Customizable system instructions that are additive to a base model’s system prompts or content generation filters.

6. Product features that require a model to cite sources of its outputs or otherwise provide visibility into the provenance of the model’s outputs.

6. AI System/LLM model evaluation tools that enable comparisons either between a model’s outputs, or across various models.

1. Third Party Modification Disclosure The Contractor shall disclose of any additional controls to modify an AI Model’s/LLM’s output applied by the Contractor if the Contractor is not a direct developer of the LLM (e.g., classifiers, system prompts, fine-tuning, content moderation and filters, etc.)

Deliverable:

A. AI System/LLM Development and Operation Documentation Package

MONITORING, REPORTING, AND CORRECTIVE ACTION

The Contractor shall develop and implement a Compliance Monitoring and Reporting Plan supporting ongoing monitoring processes to evaluate AI outputs for compliance with Trustworthy AI and Unbiased AI principles. This plan shall include the mechanism for authorized users to provide end user feedback to report suspected violations of Truth-Seeking or Ideological Neutrality requirements.

The Contractor shall notify the COR within 10 business days of identifying any material deviation from these principles and shall submit a written Corrective Action Plan describing mitigation steps, responsible parties, and timelines. Any material deviation, corrective action taken, and results shall be detailed in the <Weekly or Monthly> Progress Reports.

Deliverable:

1. Compliance Monitoring and Reporting Plan

1. Corrective Action Plan

AI MODEL UPDATES AND CHANGE DISCLOSURES

The Contractor, in an AI Model/LLM Change Disclosure, shall notify the Government throughout the PoP in advance of any material changes to AI models, including new AI enhancements, features and/or components, controls, retraining, classifiers, system prompts, fine-tuning, content moderation, filters, version replacement, or architectural changes, that could reasonably affect compliance with Trustworthy AI or Unbiased AI principles. Updated documentation shall be provided to VA for VA approval prior to implementation of such changes.

Deliverable:

1. AI Model/LLM Change Disclosure

SECURITY AND PRIVACY REQUIREMENTS

POSITION/TASK RISK DESIGNATION LEVEL(S)

23.108 Solicitation provisions and contract clauses (Excerpt).

(a) General. Insert the clause at 52.223-23, Sustainable Products, in solicitations and contracts unless a written justification or exception (see 23.103(b) and 23.105, respectively) covers the entire acquisition.

23.103 Procedures (Excerpt)

(a)Work with the requiring activity to identify sustainable products that apply to the acquisition.

(b) When it is not practicable to procure a sustainable product (see 23.102(a)), include a justification explaining the circumstances in the contract file.

(c) Ensure the solicitation and contract identify sustainable products that are required to be provided during performance of the contract and those that are covered by a justification described in paragraph (b)

23.102 Policy

(a) Agencies must procure sustainable products to the maximum extent practicable. Procuring a sustainable product is considered practicable, unless the agency cannot acquire the sustainable product—

(1) Competitively within a reasonable performance schedule;

(2) That meets reasonable performance requirements; or

(3) At a reasonable price.

(b) When considering whether the price of a sustainable product is reasonable, agencies should consider whether the product is cost-effective over the life of the product.

23.105 Exceptions (Excerpt)

(a)Contracts performed or supplies delivered outside of the United States are not required to include sustainable products, unless the agency head determines that such application is in the interest of the United States.

SOLICITATION INSTRUCTIONS FOR INFORMATION TECHNOLOGY USING SUSTAINABLE PRODUCTS

Response Instructions: Offerors shall provide with its quote/proposal a self-certification that the identified/proposed sustainable product(s) as of the date of the submission of the quote/proposal meet the required Energy Star certification and/or FEMP Low Standby Power designation as required. Failure to include the requisite Offeror’s self-certification may render the Offeror’s proposal/quotation unacceptable and thus, ineligible for award. The Government will rely on the Offeror’s self-certification that its proposed products meet the Sustainable Products requirements indicated. VA reserves the right to request additional information should VA determine it is in the Government’s best interest.

Certification:

I hereby certify that all products proposed meet the required Energy Star and/or FEMP Low Standby Power certification/designation respectively. I further certify that I am authorized to execute this certification on behalf of <insert name of Offeror>.

Printed Name of Signee: ________________________________________ Printed Title of Signee: _________________________________________ Signature: ___________________________________________________ Date: _____________________ Company Name and Address: ______________________________________

ARTIFICIAL INTELLIGENCE EFFORTS

Response Instructions: Offerors shall, if Artificial Intelligence (AI) is part of the Contractor system/solution, provide the below self-certification with their quote/proposal affirming that the identified/proposed AI System/LLM complies with the two Unbiased AI Principles, Truth-seeking and Ideological Neutrality, as required by the Office of Management and Budget (OMB) Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles”, or indicate otherwise that a self-certification is Not Applicable. Additionally, Offerors shall self-certify that the content requested within the AI System/LLM Development and Operation Documentation, as identified in OMB Memorandum M-26-04 as Transparency Documentation, will be provided for its proposed AI System/LLM during the period of performance, meet the required transparency threshold and align with the two Unbiased AI Principles. Failure to include the requisite Offeror’s self-certification may render the Offeror’s proposal/quotation unacceptable, and therefore ineligible for award. The Government will rely on the Offeror’s self-certification that its proposed AI System/LLM adheres to the Unbiased AI Principles and related requirements. VA reserves the right to request additional information if it determines that doing so is in the Government’s best interest.

Certification:

Printed Name of Signee: _________________________________________ Printed Title of Signee: ___________________________________________ Signature: _____________________________________________________ Name (and version) of its proposed AI System/LLM: _________ __________ Date: _________________________________________________________ Company Name and Address: _____________________________________

“H Clause” Incorporation Artificial Intelligence in VA Contracts For purposes of this clause, AI is defined as set forth by VA and Section 238(g) of the National Defense Authorization Act for Fiscal Year 2019 to include:

1. Any artificial system that performs tasks under varying and unpredictable circumstances without significant human oversight, or that can learn from experience and improve performance when exposed to data sets.

1. An artificial system developed in computer software, physical hardware, or other context that solves tasks requiring human-like perception, cognition, planning, learning, communication, or physical action.

1. An artificial system designed to think or act like a human, including cognitive architectures and neural networks.

1. A set of techniques, including machine learning (ML), that is designed to approximate a cognitive task.

1. An artificial system designed to act rationally, including an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communicating, decision making, and acting.

The Contractor shall provide a list of all AI it will be proposing, creating, delivering, and/or using as part of contract performance, for VA approval. The list of AI shall be provided directly to the VA PM, COR, and CO at least annually but also at the following times: upon proposal submission, contract award, the COR’s request, and upon the Contractor’s proposed use of new AI tools not contemplated at the time of last reporting. AI shall not be used in performance of the contract without the written approval and authorization of the CO. The Contractor shall also report all AI intended for use in contract performance for VA’s inclusion in the VA AI Use Case Inventory. The Contractor shall actively engage in AI discovery, assessment, and compliance activities undertaken by VA.

Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation. All AI for delivery and/or use in performance of the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. The Statement of Attestation shall include, but is not limited to, a description of all controls, processes, technologies, and mechanisms utilized to satisfy VA’s six (6) AI Principles: Purposeful, Effective and Safe, Secure and Private, Fair and Equitable, Transparent and Explainable, and Accountable and Monitored. The Statement of Attestation shall also certify that the Contractor owns or possesses all legally required rights, copyright, and licenses to use the specified AI. The Statement of Attestation shall clearly state that the use of the AI by VA personnel in performance of the contract:

1. Does not and will not infringe upon any intellectual property rights of any kind.

2. Does not violate any intellectual property rights of any kind.

3. Does not violate any other third-party rights of any kind.

The Statement of Attestation shall also affirm that there have not been any persisting or existing material errors, defects, failures, or interruptions in AI performance of its intended purpose. Additionally, the Statement of Attestation shall include the Contractor’s endorsement that the AI has materially performed in accordance with its specifications and intended purpose. Lastly, the Statement of Attestation shall be updated and resubmitted, at a minimum, annually, prior to the exercise of any contract option periods. The Statement of Attestation shall be deemed separate from, and in addition to, the Contractor’s reporting requirements relative to the use of AI. The Statement of Attestation is a material term of the contract; accordingly, failure to provide the Statement of Attestation, to include all requirements, may be deemed a breach of contract and thus, cause for termination.

Data Ownership and Use. VA data (“Data”) shall include data collected, used, processed, stored, or generated as the result of the use of AI. VA data is and shall remain the sole and exclusive property of VA. Contractor is provided a limited, non-exclusive license to access and use Data solely for performing its obligations under the Contract. The Contractor shall: (a) keep and maintain VA data in strict confidence and as further described in this Contract and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) not use, sell, rent, transfer, distribute, or otherwise disclose or make available VA Data for Contractor’s own purposes or for the benefit of anyone other than VA without the CO’s prior written consent; and (c) not store, use, and transmit VA Data outside of the United States. This applies to both identified and de-identified data.

The Contractor (or Subcontractor at any tier, including affiliates, third-party affiliates, and any other non-VA entities) shall not sell, monetize, release, share, reuse, transfer, or misuse any VA data, to include any models, training data, testing data, patterns, documentation, implementation artifacts, runtime artifacts, or any other digital artifacts, partially or as a whole, derived from AI or machine learning (ML) without the express written consent and approval from the CO.

The Contractor is prohibited from using non-public VA data, including Veteran data, and outputted results to train publicly or commercially available AI algorithms, fine-tune, or otherwise develop AI or ML models for reuse, transfer, or commercial purposes, without the express written authorization from the CO specifying VA data that may be used along with the acceptable scope of such usage. Contractor agrees that any AI models, weights, or derivative artifacts trained, or fine-tuned, on VA non-public data, if authorized by VA, may not be commercialized or used for the benefit of any third party without prior written approval by the CO and must be conducted within a VA authorized environment that has obtained an Authority to Operate

The Contractor shall indemnify VA and its officers, employees, and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark, or copyright, arising out of VA use of any AI products and/or services under the contract.

The Contractor shall maintain commercially reasonable insurance coverage for claims or losses pertaining to the AI products or services being used in performance of the contract.

The Contractor shall maintain commercially reasonable and industry standard conforming security safeguards and controls, including proper access controls for the AI. The Contractor agrees the VA Contracting Officer has the unilateral right to require deactivation of any AI for any reason and without notice.

Any development and/or creation of AI, including any AI derivatives, during performance of this contract, is subject to applicable Intellectual Property and data rights clauses under the Federal Acquisition Regulation (FAR) including, FAR 52.227-14. The VA retains the unlimited right to reuse, share, and/or redeploy AI code and AI models procured under this contract. License rights in any Commercial Computer Software shall be governed by this contract.

This clause applies to both existing and new uses of AI, both stand-alone AI and AI embedded within other systems or applications, AI developed both by VA or by third parties on behalf of agencies for the fulfilment of specific VA missions, including relevant data inputs used to train AI and outputs used in support of decision making, and VA procurement of AI applications.

This clause does not apply to AI embedded within common commercial products, such as word processors or map navigation systems. The Contractor shall inform the VA Contracting Officer in writing if it believes the AI it intends to use during contract performance is not covered by this clause. The burden to demonstrate the AI is a common commercial product shall rest solely with the Contractor.

Non-compliance with the terms above, or loss of sensitive VA medical records information resulting from AI use (whether accidental or intentional), may result in Contractor liability to VA for any and all rights and remedies provided by law, including but not limited to contract termination, liquidated damages, and referral to VA’s Suspension and Debarment Committee.

The Contractor shall include the substance of this clause in all subcontracts, including Subcontractors at any tier, affiliates, third-party affiliates, and any other non-VA entities.

INFORMATION SECURITY CONSIDERATIONS

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

image1.jpeg