Sole-Sourcing AI to an SDVOSB: The $5M Direct-Award Path

What does the $5M path actually require?

Four conditions, each with a concrete evidence requirement. FAR 19.106-3 (the section formerly numbered 19.1406) lets you sole-source to an SDVOSB when:

1. No reasonable expectation of two or more SDVOSB offers. This is the gateway — if two capable SDVOSBs would likely bid at a fair price, you owe a set-aside, not a sole source. Documented through market research (next section).
2. Within the ceiling. The anticipated price including all options stays at or below $5M for services and $8.5M for manufacturing. These figures are statutorily indexed on a five-year cycle under 41 U.S.C. 1908; the October 2025 inflation adjustment moved the SAT, micro-purchase, TINA, and J&A approval thresholds but left the SDVOSB sole-source ceilings where they were.
3. Responsible contractor. A standard FAR Part 9 determination — for AI, that means real evidence of model-development or deployment experience, the right security posture (FedRAMP authorization level if cloud is in scope, CMMC level if DoD CUI is involved), and any required clearances.
4. Fair and reasonable price. The part everyone underestimates. Covered in depth below.

You do not have to prove that only one firm can do the work. SDVOSB sole-source is the statutory exception at 6.302-5(b)(6), not the uniqueness exception at 6.302-1 — a distinction we unpack in the FAR Part 19 piece. Here, just know the practical effect: your justification is materially lighter.

How do you document “no reasonable expectation of two offers”?

Market research under FAR Part 10 carries this finding, and GAO gives agencies real deference on its depth — but only if the file shows you actually looked. A bare assertion fails; a documented search holds.

For an AI requirement, the field narrows legitimately on capability. A specific tech stack, an active ATO on a particular cloud, niche model-evaluation expertise, a defined clearance level — each of these is a defensible reason to expect a thin SDVOSB field. Build the record like this: run NAICS-coded queries against SBA’s certification database at search.certifications.sba.gov and the SAM.gov socioeconomic filter; document the specific technical, security, and domain qualifications the requirement demands; issue a Sources Sought or RFI on SAM.gov if the SDVOSB landscape is uncertain; and state in the file why fewer than two SDVOSBs are reasonably expected to submit a responsive offer at a fair price. Geographic narrowing has been upheld where reasonable.

One distinction matters governmentwide versus at the VA. Outside the VA, the SDVOSB Rule of Two is “shall consider,” not “shall do” — GAO confirmed in Protection Strategies (August 2025) that the language doesn’t force a subcategory set-aside; a general small-business set-aside can satisfy it. Inside the VA, the Rule of Two is mandatory and reaches even Schedule orders, per Kingdomware. (More on the VA variant below.)

How do you set a fair price when there’s no competition and no comparables?

This is the section most contracting officers most need, because there is no clean market price for a generative-AI evaluation harness, a custom RAG deployment, or a domain-specific fine-tune. Here’s the workflow that produces a defensible determination.

1. Decide whether it's commercial — first

   Under FAR 2.101 and Part 12, an AI service “of a type” customarily sold to the public, or modified only minorly, is a commercial service. If it is, FAR 15.403-1(b)(3) prohibits you from requiring certified cost or pricing data at all — regardless of dollar value, even above the TINA threshold. Commercial SaaS-style AI, off-the-shelf inference platforms, and consulting priced on published GSA Schedule labor rates are typical candidates. This one determination eliminates the largest compliance burden in the whole acquisition. You still owe a fair-and-reasonable finding — a catalog price isn’t automatically reasonable — but you do it with price analysis, not cost analysis.

2. Check whether TINA even applies

   The Truthful Cost or Pricing Data Act threshold rose to $2.5 million effective October 1, 2025, and climbs to $10 million for DoD contracts entered after June 30, 2026, under the FY2026 NDAA. Below the threshold, or on any commercial acquisition, you request “data other than certified cost or pricing data” under FAR 15.403-3 — proposal-level pricing detail, not audited cost submissions.

3. Build the IGCE — your anchor

   The Independent Government Cost Estimate is the single most important document in a no-competition price file. Use a labor build-up: labor categories × hours × fully burdened rate, plus other direct costs (cloud and compute, data acquisition, third-party APIs), plus indirects and profit. The DoD IGCE Handbook for Services Acquisition (October 2025) frames the labor math — roughly 1,880 productive hours per full-time equivalent after standard leave — and the NITAAC Agile Software Development IGCE template gives a sprint-based estimator for iterative AI work. The trick that traditional IGCEs miss: separate the build phase from the run phase. Training and integration are compute-heavy and front-loaded; steady-state inference is a predictable per-call or per-token cost. Estimate each against current published cloud rates rather than blending them into one opaque number.

4. Triangulate against published data

   No single source carries a sole-source price finding; GAO expects multiple methods. Benchmark proposed labor rates against the GSA CALC+ database of actual award rates (an input, never the sole basis — GAO has said relying on CALC+ alone is improper), against GSA Schedule rates at the same clearance levels, and against BLS Occupational Employment Statistics with a documented wrap-rate adjustment. Where the SDVOSB sells comparable services commercially, compare to its published price list under FAR 15.404-1(b)(2)(iv).

5. Apply the FAR 15.404-1(b)(2) techniques — more than one

   For an AI engagement the defensible combination is usually comparison to the IGCE, comparison to prices from market research, and analysis of data other than certified cost or pricing data. Stack them; don’t lean on one.

6. Write it down in a Price Negotiation Memorandum

   Contemporaneous documentation is what wins protests. In MCI Diagnostic Center (October 2024), GAO upheld a price-reasonableness finding built on an IGCE derived from payment history and adjusted for added scope, expressly because the agency documented the build-up logic against the FAR techniques. The method was ordinary; the documentation was decisive.

7. Bake in the M-25-22 AI terms — they affect the price

   OMB Memorandum M-25-22 (April 3, 2025) applies to AI solicitations issued on or after September 30, 2025 and requires contract terms for pricing transparency and anti-lock-in (knowledge transfer, data and model portability, clear licensing); a permanent prohibition on training public or commercial models on your non-public agency data without consent; agency testing rights before and during performance; and IP rights scoped to the intended use. These aren’t boilerplate — portability requirements, testing access, and licensing scope all move the price, so put them in the SOW before you negotiate, not after. The text-to-procurement mapping is in OMB M-25-21 reads like a buying spec.

What goes in the J&A and the contract file?

Cite FAR 6.302-5(b)(6) as the authority — not 6.302-1. Then assemble:

The written justification with the FAR 6.303-2 elements (requirement description, statutory authority, the market-research summary, the fair-and-reasonable-price determination, and the actions you’ll take to foster competition in future buys). Route it for approval at the FAR 6.304 tier that matches the value: the CO self-certifies up to $900,000; the competition advocate approves $900K–$20M — and a five-year, option-loaded $5M ceiling lands there. Synopsize the intended action under FAR 5.201 before award, and post the J&A on SAM.gov within 30 days after award under FAR 6.305. Verify SDVOSB certification at time of offer per FAR 19.106-1(c). Below the simplified acquisition threshold ($350,000 as of October 2025), use FAR Subpart 13.5 and skip the formal J&A entirely.

How do you scope an AI requirement to fit $5M?

Three rules:

Don’t split or subdivide. A requirement that genuinely exceeds $5M cannot be carved into sub-$5M slices to fit the authority — the VA states this expressly at VAAR 819.7008(e), and the FAR carries the same principle through the bundling rules and the “include all options” instruction. This is a fast way to lose a protest.

Phase legitimately. Separable phases that each have standalone value — a discovery/POC contract that informs whether and how to build, then a production build, then sustainment — are not improper splitting. Document the analytical basis for the phasing in the acquisition plan. A six-month prototype that de-risks the production decision is a real, separate requirement.

Write it outcome-based. FAR Subpart 37.6 and M-25-22 both push Statements of Objectives over prescriptive Statements of Work for AI. Define accuracy targets on a held-out evaluation set, latency budgets, drift thresholds, and model-card deliverables — outcomes you can price and defend — rather than a task-by-task script. Default to firm-fixed-price for commercial AI with defined outcomes; reserve time-and-materials for genuinely undefined discovery work (and only with the FAR 16.601(c) finding that no other type fits); use a hybrid (fixed-price build plus not-to-exceed compute CLINs) when consumption is the wildcard.

What about the 50% rule and certification?

Self-performance. FAR 52.219-14 requires the SDVOSB prime to self-perform at least 50% of a services contract — measured by the amount the government pays, excluding work paid to similarly-situated entities (other SBA-certified SDVOSBs that are small under the subcontract’s NAICS code). Specify in the clause whether compliance is measured at the contract or order level, and require periodic certification on task-order vehicles.

Certification. SBA — not the VA — has certified SDVOSBs since January 1, 2023, through VetCert. Self-certification ended December 22, 2024 under Section 864 of the FY2024 NDAA; an uncertified firm is ineligible for these awards. Verify status at search.certifications.sba.gov and in SAM at time of offer. Size standards for the common AI/IT codes: 541511, 541512, and 541519 each carry a $34M standard; 541990 is $19.5M; 541715 is employee-based. A large SBA size-standard rulemaking proposed in August 2025 may raise many of these — confirm the current figure for your assigned NAICS at award.

What’s different at the VA?

VA-specific. At the VA, sole-source SDVOSB awards run under VAAR 819.7008 and VAAR 806.302-570, not the governmentwide FAR section. Three differences matter. First, the Veterans First Contracting Program (38 U.S.C. 8127/8128) requires the VA to prioritize SDVOSBs — then VOSBs — ahead of governmentwide socioeconomic programs. Second, under Kingdomware, the VA Rule of Two applies to all contracting actions, including Federal Supply Schedule orders. Third, the $5M ceiling and the explicit “shall not split or subdivide” prohibition are codified directly in VAAR 819.7008. SBA VetCert is now the VA’s verification source; older VAAR references to the retired “VIP” database now mean SBA-certified. A VA contracting officer should default to VAAR Subpart 819.70 over the general FAR analysis.

Where do these awards go wrong?

Five failure points, in order of how often they bite:

1. Thin market research. The number-one protest ground. In SteerBridge Strategies (December 2024), the VA took corrective action and resolicited after a protest alleging insufficient Rule-of-Two market research. Document the certified-vendor search and the basis for your finding.
2. Improper splitting. Phasing must reflect genuine separability, not a workaround for the ceiling.
3. A weak price file. “The price is fair and reasonable,” with no IGCE, no comparison data, and no PNM build-up, is the standard ground for a sustained protest on novel scope.
4. Certification timing. Status must exist at time of offer. A lapsed certification means ineligibility, full stop.
5. The SBA appeal. Under 13 CFR 128.407, the SBA Administrator can appeal a CO’s decision not to set aside or sole-source to an SDVOSB, and you respond through the head of the contracting activity within 15 working days. A documented file is the defense — and note the asymmetry: there’s no comparable challenge to a decision to use the authority. For year-end timing constraints on all of this, see year-end funds, fast; the broader credentialing argument is in SDVOSB is leverage. Use it.

Working with Truvisory

If you’ve scoped an AI requirement that fits this lane, the vendor side is quick to verify. Truvisory is a Denver-based, SBA-verified Service-Disabled Veteran-Owned Small Business that ships production AI on Cloudflare’s edge under fixed-scope, 30-to-90-day delivery — the contract type that prices cleanly and defends easily.

Confirm all of it in SAM.gov and at search.certifications.sba.gov before you write the J&A. When you’re ready, start with our federal capability statement and a scoping call — and for the regulatory backdrop, see the FAR Part 19 direct-award piece and the federal AI modernization pillar.