RFI 26-002 - Purchasing Memorandum II - Answers to Questions and Inquiries.pdf

Office of the New York State Attorney General

Letitia James

The Capitol, Albany NY 12224 / 1-800-771-7755 / Fax 518-650-9401 / ag.ny.gov

Purchasing Memorandum No. 2

DATE: August 6, 2026

PLEASE ADDRESS INQUIRIES TO:

Ashley Brown, Contract Management Specialist Trainee 2 Telephone Number: (518) 776-2168 E-Mail: purchase@ag.ny.gov

INVITATION FOR BID NO.: 26-002

TITLE: RFI 26-002 - Modern eDiscovery Platform with Secure AI Supported Capabilities

RESPONSE DUE DATE: 8/18/2026

SUBJECT: Answers to Questions/Inquiries

TO: ALL PROSPECTIVE VENDORS

In reference to the above Request for Information, the following questions/inquiries were submitted by the July 24, 2026, deadline. We are hereby providing answers to each question below:

1. QUESTION: Approximately how much data does the agency expect the platform to store in total (emails, files, chats, etc.)?

ANSWER: OAG anticipates approximately 20 TB of data uploaded per year.

2. QUESTION: What file types make up the majority of OAG's document collection (e.g., emails, PDFs, scanned images, audio, video)?

ANSWER: OAG hosts a broad array of document types including emails, PDFs, scans, and media, with no outlier in any specific group in terms of storage size or document count.

3. QUESTION: What is the approximate number of cases/matters that OAG handles each year?

ANSWER: 250 - 300

4. QUESTION: How many users will require access to the platform?

ANSWER: 2500 - 3000

5. QUESTION: How many reviewers does OAG expect to be working concurrently during document review?

ANSWER: 75 – 150 concurrent reviews

6. QUESTION: Will external or guest reviewers require licensed access? If so, approximately how many?

ANSWER: 1000 - 1500

7. QUESTION: Is OAG currently using an eDiscovery platform? If yes, which platform? And is the agency looking to replace or deploy a new one alongside the existing one?

mailto:purchase@ag.ny.gov

ANSWER: OAG is currently using Relativity Server 2025. Relativity Server reaches end of life at the end of December and will be retired in favor of a new platform.

8. QUESTION: Can OAG share the names of the current case management and ticketing systems the new platform is expected to integrate with, so vendors can confirm existing connector or API support?

ANSWER: OAG is not expecting specific integration with any named case management systems, ticketing systems, or archives, but would like to know any out-of-the-box support a proposed solution has.

9. QUESTION: If OAG is looking replace their current platform, approximately how much existing data will need to be migrated?

ANSWER: The final volume of data to be migrated is dependent on individual matters’ timelines, agency priority, and total downtime for migration. The migration could realistically range from 20 – 180 TB.

10. QUESTION: Are there any active cases or legal holds that must be migrated without disrupting ongoing work?

ANSWER: Yes, expect migration of active cases.

11. QUESTION: In Section 2, OAG refers to a "cloud-based EAM solution." Should this instead refer to a "cloud-based eDiscovery solution"? We'd like to confirm that we have understood the scope correctly.

ANSWER: Please disregard reference to “Cloud-based EAM Solution”. The information received from this RFI may be used to issue a Request for Proposal (RFP) to procure a cloud-based eDiscovery solution, including implementation services.

12. QUESTION: In Section 3.5, OAG has mentioned that vendors should align with your "Identity Governance RFP requirements." Is that document available for vendors to review?

ANSWER: The OAG is unable to share the “Identity Governance” RFP document at this time.

13. QUESTION: Does the OAG require the platform to natively generate standard eDiscovery load files (such as .DAT, .OPT, or LFP) containing redacted TIFF/PDF images and extracted text, or is the secure sharing of natively redacted files within Box sufficient?

ANSWER: OAG is required on matter-specific bases to produce standard eDiscovery load files with redacted TIFF images, standard eDiscovery load files with redacted PDFs, as well as standard eDiscovery load files with redacted near-natives when applicable. OAG may be required to provide copies of productions on physical media as well.

14. QUESTION: Case Management Systems: Section 3.5 mentions integration with "case management systems." Could the OAG identify the specific case management or ticketing platforms currently in use (e.g., Tyler Technologies, LegalFiles, Salesforce, or custom-built systems) to help us detail our API/SDK integration capabilities?

15. QUESTION: Identity Governance & Entra ID: Section 3.5 references "Identity Governance RFP requirements and discussions." Can the OAG provide the specific technical standards or schemas required for automated provisioning/deprovisioning via SCIM with Entra ID?

ANSWER: The OAG is unable to share the “Identity Governance” RFP document at this time.

16. QUESTION: Historical Data Migration: Section 3.7 requests information on "migration strategies." Does the OAG intend to migrate active or archived case data from legacy eDiscovery tools into the new platform, and if so, what is the estimated volume of historical data to be migrated?

ANSWER: Yes, the OAG intends to migrate active or archived case data from legacy eDiscovery tools into the new platform. Estimate volume is to be determined.

17. QUESTION: Sizing and Licensing Metrics: To help us outline the most cost-effective pricing models (Section 3.8), could the OAG provide the approximate number of internal users (attorneys, investigators, records officers) and the estimated annual data ingestion volume (in Terabytes) expected for the platform?

ANSWER: OAG expects 2500 - 3000 active users and approximately 20 TB of data ingestion per year.

18. QUESTION: External Collaboration Volume: Section 3.4 mentions support for "external guest reviewers."

Does the OAG have an estimate of the volume or ratio of external guest users (e.g., outside counsel, joint task force members) relative to internal OAG staff?

ANSWER: OAG expects access for approximately 2000 employees and 1000 external users.

19. Platform scope: Must the proposed solution provide all requested capabilities natively, or may respondents describe an integrated platform that uses subcontractors, third-party products, or partner services?

ANSWER: Please include your approved 3rd Party Vendor list as well as information regarding your Vendor Approval process

20. Section 3.1 Current environment and scale: Can OAG provide approximate ranges for annual data intake, active hosted volume, matter count, concurrent matters, total users, peak concurrent reviewers, and typical versus largest matter size?

ANSWER: OAG currently hosts approximately 200 TB of active data over 1,300 matters, with approximately 30 concurrent matters monthly. OAG serves a total user base of 2500 – 3000 users, with peak concurrent use around 150. OAG matters do not conform to typical sizes though most workspaces are under 50 GB, the OAGs current largest active matter is 16 TB.

21. FOIL workflows: Is OAG seeking end-to-end FOIL request management—including intake, assignment, deadlines, correspondence, exemptions, appeals, and release—or only collection, review, redaction, and production?

ANSWER: OAG is not specifically requiring end-to-end FOIL request management but would like to know of all capabilities relating to FOIL management, including document review for FOIL responses, that a proposed solution provides.

22. Sections 3.2 & 3.3 Data residency and access: Must all content, metadata, backups, telemetry, and AI processing remain in the United States? Are offshore support personnel or subprocessors prohibited from accessing OAG environments or data?

ANSWER: Yes

23. Section 3.2 Deployment expectations: Does OAG have a preferred or minimum acceptable deployment model: commercial government cloud, FedRAMP-authorized cloud, sovereign cloud, private tenant, hybrid, or on-premises?

ANSWER: FedRAMP-authorized cloud

24. AI models and hosting: Are third-party foundation models acceptable if customer content is contractually excluded from training and processed within an approved security boundary? Must AI inference occur in OAG’s tenant or a dedicated environment?

ANSWER: Yes

25. AI governance: Are there specific NYS AI policies, risk assessments, approval processes, prohibited uses, human-review requirements, or documentation templates respondents should address?

ANSWER: OAG’s AI vendor questionnaire will be attached as a reference document only, and is not required to be completed as part of the RFI submission.

26. Section 3.3: Security requirements: Which certifications and frameworks are mandatory at contract award, and which may be demonstrated through alignment or a remediation roadmap? In particular, is FedRAMP authorization required, and at what impact level?

ANSWER: FedRAMP Moderate

27. CJIS applicability: Will the solution store or process criminal justice information subject to CJIS requirements? If so, what CJIS hosting, personnel-screening, access, and geographic-location requirements will apply?

ANSWER: Must meet New York CJIS requirements

28. Section 3.5: Microsoft environment: Please confirm whether “GCC-moderate G5” refers to Microsoft 365 GCC, GCC High, or another environment, and identify any applicable tenant-boundary or API restrictions.

ANSWER: Microsoft 365 GCC

29. Case and records integrations: Can OAG identify the case-management, ticketing, archive, identity-governance, and records-management systems with which integration may be required?

30. Section 3.7: Migration scope: Does OAG anticipate migrating data from existing eDiscovery or public-records systems? If so, can OAG identify the incumbent platforms, approximate volumes, supported export formats, and whether historical audit data must be preserved?

ANSWER: OAG will be migrating case data from the existing Relativity Server 2025 platform. Historical Audit data must be preserved.

31. Section 3.8: Pricing assumptions: What baseline assumptions should vendors use for the five-year TCO range so that responses are comparable, for example users, hosted volume, annual ingestion, processing, productions, AI usage, environments, and support level?

ANSWER: OAG currently hosts approximately 200 TB of active data over 1,300 matters, with approximately 30 concurrent matters monthly. OAG serves a total user base of 2500 – 3000 users, with peak concurrent use around 150. We cannot estimate AI usage at this time.

32. Can OAG provide additional guidance on its preferred service delivery model for the future solution?

Specifically, should respondents assume a self-managed SaaS platform operated primarily by OAG personnel, a shared-responsibility model with ongoing vendor support, a fully managed services approach, or should multiple operating models be addressed in the response?

ANSWER: OAG expects to self-manage the platform to the greatest extent possible. Currently, we manage our platform with in-house technical staff. We prefer this model for efficiency and effectiveness but will evaluate other approaches including hybrid.

33. Which security/compliance frameworks are mandatory versus preferred: FedRAMP, NIST 800-53, or NYS-specific controls?

ANSWER: All of the above

34. Does OAG require data residency within the United States, a government cloud, or another specific boundary?

ANSWER: US GovCloud

35. Does the OAG envision FOIL/public records requests and litigation/investigative matters being managed within the same platform environment, or would separate repositories, workspaces, or environments be preferred?

ANSWER: FOIL and public records requests would happen in the same environment as litigation and investigative matters, but in separate workspaces.

36. Is CJIS compliance considered a mandatory requirement for the anticipated solution, or is it being evaluated as a desirable capability depending on the use case and data types involved?

ANSWER: Desired

37. Is FedRAMP authorization a mandatory requirement for a future procurement, or will alternative security frameworks and certifications be considered?

ANSWER: FedRAMP is a mandatory requirement.

38. The RFI references a future cloud-based solution. Would OAG also consider on-premises or hybrid deployment models where data remains under direct agency control? OpenText supports cloud, hybrid, and fully on-premises deployment options and would like to understand whether all deployment models are in scope.

ANSWER: OAG recognizes that each deployment model has unique advantages and challenges. While we favor a cloud environment that helps lessen in-house administrative burden, we are open to understanding the advantages of what each model provides.

39. Does OAG anticipate requiring vendor-provided forensic collection services as part of a future solution, including collections from Microsoft 365, endpoints, mobile devices, cloud repositories, and other data sources?

ANSWER: OAG does not anticipate vendor collections.

40. Beyond the core platform, does OAG anticipate a need for optional managed services to support litigation, investigations, regulatory matters, public records requests, breach response, and other review-intensive matters? Such services may include managed review, breach review, investigative review, consulting, analytics support, and related professional services delivered in conjunction with the underlying technology platform.

ANSWER: Not at this time

41. Does OAG have estimated data volumes, annual processing volumes, concurrent user counts, or projected case volumes that could be shared to assist vendors in sizing and architecting their proposed solutions?

ANSWER: OAG processes approximately 20 TB of data per year, expects 75 – 150 concurrent users, and 250-300 new matters per year.

42. Is accessibility compliance with WCAG 2.1 and Section 508 considered mandatory, or are these standards being treated as preferred evaluation criteria?

ANSWER: Yes, it would be a mandatory requirement.

43. Can the OAG clarify whether it is open to secure commercial cloud AI capabilities only, or whether it expects responders to support isolated deployment options such as private tenant, sovereign cloud, hybrid, or customer-controlled model hosting for AI-assisted workflows?

ANSWER: OAG expects responders to support isolated deployment options.

44. For Section 3.2, what level of specificity does the OAG expect regarding underlying AI models, sub-processors, and model lifecycle disclosures at the RFI stage versus a future solicitation stage?

ANSWER: Vendors should disclose AI models, sub-processors, and model lifecycles at the RFI stage.

45. Will the OAG consider solutions that use third-party foundation models where customer data is contractually isolated and not used for training, or is there a preference for vendor-owned or fully self-contained AI services?

ANSWER: OAG is seeking self-contained AI services .

46. Can the OAG provide additional guidance on any categories of especially sensitive or regulated data that would require stricter handling, residency, segmentation, or AI restrictions beyond standard legal confidentiality controls?

ANSWER: Data must be protected per HIPPA Security Rules

47. Is the OAG currently contemplating FedRAMP Moderate equivalency, FedRAMP authorization, or another specific compliance threshold as the likely minimum for a future cloud-based procurement?

ANSWER: FedRAMP Moderate equivalency

48. Does the OAG anticipate CJIS requirements applying broadly across the platform environment, or only for certain matters, business units, or investigative workflows?

ANSWER: CJIS principles will apply to all workspaces housing CJI. OAG would need the ability to dynamically implement CJIS principles whenever CJI enters a workspace.

49. In Section 3.5, does the OAG expect native collection and integration support specifically for Microsoft 365 GCC Moderate/G5 components, and are there any known limitations or boundary conditions in the current tenant that responders should account for?

ANSWER: Solution should be able to natively accept content from various sources.

50. Can the OAG clarify whether it expects the solution to integrate directly with Microsoft Purview, Teams, and related M365 preservation/export workflows, or whether collection will primarily occur through existing OAG processes and exports?

ANSWER: OAG expects to leverage direct connectors to Microsoft Security and Compliance suite of applications for the ingestion of new data when applicable.

51. Can the OAG share which identity lifecycle and access governance capabilities are considered mandatory at this stage, particularly with respect to Entra ID provisioning, deprovisioning, guest access, and role-based review access?

ANSWER: Users of the solution should be able to respect all role-based access control provided by Entra

ID.

52. Which case management systems, archives, or ticketing platforms are the highest-priority integration targets for the OAG so vendors can focus their response on the most relevant interoperability scenarios?

ANSWER: OAG is not expecting specific integration with any named case management systems, ticketing systems, or archives, but would like to know any out-of-the-box support a proposed solution has.

53. Can the OAG provide directional assumptions about FOIL/public records workload volume, such as number of requests, custodians, data sizes, or concurrent review teams, to help vendors describe fit-for-purpose workflows and operating models?

ANSWER: Document review for FOIL and public records requests are not handled any differently than other matters, and as such OAG processes approximately 20 TB of data per year, expects 75 – 150 concurrent users, and 250-300 new matters per year.

54. For Section 3.6, will the OAG expect current VPAT documentation and formal accessibility testing evidence at the RFI stage, or is a summary of WCAG 2.1 / Section 508 conformance sufficient for now?

ANSWER: A simple summary is sufficient at the RFI stage.

55. Does the OAG anticipate a net-new implementation, a replacement of one or more current systems, or a phased coexistence model, and are there legacy repositories or active matters that a future implementation would likely need to migrate?

ANSWER: OAG is currently using Relativity Server. Migration vs. phased coexistence of data will be dependent on individual matters’ timelines, agency priority, and total downtime for migration. The migration could realistically range from 20 – 180 TB.

56. For Section 3.8, would the OAG prefer that vendors organize indicative pricing around specific usage scenarios or profiles, such as matter-based, annual volume-based, or role-based licensing models, to make future comparisons more meaningful?

ANSWER: OAG prefers indicative pricing to be accurate and predictable to the extent possible, but has no specific preference on how any individual product is priced.

57. If demonstrations are requested under Section 5, which workflows would the OAG most want to see emphasized—for example intake and processing, FOIL review and redaction, AI-assisted review, M365 collection, auditability, or administrative governance?

ANSWER: OAG treats the EDRM workflow holistically, so no specific features or more or less important than another. Therefore, OAG would request end-to-end demonstrations of production functionality and capabilities.

58. While Section 3.1 addresses complex data types, can the OAG share its current total active data footprint (in Terabytes/Gigabytes) across active litigation and regulatory matters, as well as estimated annual ingestion volumes, to help vendors provide realistic 5-year Total Cost of Ownership (TCO) models?

ANSWER: OAG currently hosts approximately 200 TB of active and ingests approximately 20 TB per year.

59. Does OAG have an anticipated timeframe for releasing a formal Request for Proposals (RFP) following this RFI process?

ANSWER: The OAG does not have an anticipated timeframe for releasing an RFP at this time.

60. Is the OAG envisioning a self-service Software-as-a-Service (SaaS) model operated primarily by internal staff, or is the agency also seeking co-managed / fully managed eDiscovery litigation support services (e.g., project management, advanced analytics support, or forensic collection) from the vendor?

ANSWER: OAG anticipates a self-service model operated by internal staff

61. How many active users, reviewers, administrators, and legal staff are expected to use the platform?

What is the estimated volume of:

•matters per year, •custodians, •documents, •total data storage (TB/PB), •annual ingestion volume?

ANSWER: OAG expects 3000 active users and 20 administrators. IAG expects 250 – 300 matters and approximately 20 TB data growth per year. Custodial and Document counts cannot be a concern for the responding vendor, but solutions must be able to handle individual matters over 10M documents.

62. Is the OAG currently using an eDiscovery platform?

ANSWER: OAG is currently using Relativity server.

63. Is there a scope of migration of existing matters and historical data?

ANSWER: The final volume of data to be migrated is dependent on individual matters’ timelines, agency priority, and total downtime for migration. The migration could realistically range from 20 – 180 TB.

64. Are there existing document repositories (Microsoft 365, SharePoint, Exchange, file shares, cloud storage, etc.) that must be integrated?

ANSWER: OAG is not expecting specific integration with any named case management systems, ticketing systems, or archives, but would like to know any out-of-the-box support a proposed solution has.

65. Are open-source AI models acceptable if deployed entirely within a secure environment?

ANSWER: Open source AI models are acceptable as long as they are deployed within a secure environment.

66. Does the OAG have a preferred deployment model?

•SaaS •Government cloud •Private cloud •On premises ANSWER: As answered in question 38, all of these deployment models, with the likely exception of the Private cloud as the OAG requires a Government Certified environment, are acceptable.

67. Which AI capabilities are the highest priority?

ANSWER: Specific AI capabilities are not being weighed by value at this time, but OAG would like to know what out-of-the-box capabilities a proposed solution has.

68. Are there particular pain points with current eDiscovery workflows that vendors should address?

ANSWER: No specific pain points need to be addressed.

69. Pricing: Is the OAG interested primarily in:

•subscription licensing, •consumption-based pricing, •per-user licensing, •per-matter pricing, •or enterprise licensing?

ANSWER: OAG prefers indicative pricing to be accurate and predictable to the extent possible, but has no specific preference on how any individual product is priced.

70. Does the OAG anticipate product demonstrations? And, when?

ANSWER: OAG may request product demonstrations at a future date, but no current time frame for demonstrations is determined.

71. Are explainability, auditability, human review, and AI decision traceability expected requirements?

ANSWER: Yes.

72. Will AI-generated recommendations always require human approval before legal use?

ANSWER:Yes

73. Does the twenty-five (25) page limit apply to the technical response only, or does it also include the cover letter, company overview, Optional Attachments?

ANSWER: 25-page limit applies to technical response only.

74. References- •Is it sufficient to provide a summary of relevant government/public sector engagements and services performed?

ANSWER: Yes, it is sufficient to provide a summary of relevant government/public sector engagements and services.

•Should Point of Contact (POC) information be included at this stage for RFI?

ANSWER: Points of contact are not mandatory at this stage but will be acceptable.

This Purchasing Memorandum is to be signed, submitted and made a part of your response. If you have any questions, do not hesitate to contact the person listed on top of this memorandum.

VENDOR: ________________________________________________________

ADDRESS: _______________________________________________________

SIGNATURE OF VENDOR: __________________________________________

DATE: ______________________________