VA AI Modernization for SDVOSBs: The Procurement Ground Truth for 2026

Why is the VA the best federal market for an SDVOSB AI shop?

Because at VA, your SDVOSB status isn’t a tie-breaker — it’s the first thing the contracting officer is legally required to consider.

The Veterans First Contracting Program, codified at 38 U.S.C. §8127–8128 and implemented in VAAR Subpart 819.70, requires a VA contracting officer to first consider SDVOSBs, then other veteran-owned small businesses, before any other small-business set-aside (8(a), HUBZone, WOSB) and before full-and-open competition. The “Rule of Two” — if the CO reasonably expects two or more verified SDVOSBs to bid at a fair and reasonable price, the work must be set aside — was held mandatory by a unanimous Supreme Court in Kingdomware Technologies, Inc. v. United States in 2016, even for orders under the Federal Supply Schedule. This is not a goal an agency aspires to. It is a statutory sequence enforceable by protest.

While the governmentwide SDVOSB statutory goal rose from 3% to 5% under the FY2024 NDAA and federal agencies collectively hit roughly 5% / $31.9B, VA awarded $10.2B to more than 2,300 SDVOSB firms — a 23.63% prime rate that earned it an “A” on SBA’s FY2024 scorecard. No other agency runs a hierarchy like this. Everywhere else, SDVOSB set-asides sit alongside 8(a), WOSB, and HUBZone; at VA they sit in front of them. The deeper mechanics of the hierarchy — and how to make a CO’s Rule-of-Two market check come out in your favor — are the subject of the Veterans First contracting guide.

How much is the VA actually spending on AI?

Enough that AI is now a named, growing line in the budget — not a rounding error buried in IT.

The FY2026 VA IT budget is $7.3 billion, enacted in November 2025 ($5.9B discretionary IT Systems plus $1.4B from the mandatory Toxic Exposures Fund). Inside it, the AI-relevant lines are the ones to treat as procurement signals: $29 million (+130%) for mission-aligned AI use cases, $187 million (+108%) for Zero Trust Architecture, and a discrete “Decision Intelligence & Automation – Artificial Intelligence” account that grew roughly $16 million year over year to the high-$30-to-low-$40-million range. The FY2027 President’s Request goes further, proposing a separate $130 million VBA line for claims-processing automation and AI and growing the D.I.&A.–AI account toward $47.8 million.

These are the lines that matter, not the headline VA discretionary total. A new AI line growing 130% in a single year is a buyer telling you where the next requirements are coming from.

What AI is the VA actually buying — and what can a small shop win?

VA’s published AI strategy and its 2025 use-case inventory point at a clear set of workloads, and only some of them are realistically winnable for a small firm doing fixed-scope 90-day builds.

The flagship work that gets the headlines is clinical: ambient AI documentation (“AI scribes”), which VA launched as a pilot at 10 medical centers in October 2025 with Abridge (~$5.3M) and Knowtex (~$15M), then moved to scale through a contract with Rise8 (an SDVOSB) and Thoughtworks Federal. That sequence — AI Tech Sprint winner to sole-source pilot to scaled rollout — is the single best template an SDVOSB AI shop can study, and it’s broken down in the VA AI Tech Sprint follow-ons article. There’s also REACH VET, VA’s suicide-risk prediction model, and a wave of benefits-side automation in claims processing that has helped cut average processing time from 141 days to 81.

But the accessible work — the work a Denver-based solo-founder SDVOSB can actually deliver in a quarter — is in the back office: document processing and classification (mirroring VA’s “AI-Driven eFax Fix,” which cut document handling time ~31% across 13M+ annual community-care faxes), RAG over VA policy and SOPs for employee-facing assistants, RPA on benefits and administrative tasks, and contact-center augmentation. What you should not bid alone: EHR/Oracle Health modernization and enterprise clinical AI — those are prime-scale, and the realistic entry is as a sub-tier specialist. That build-vs-team line is the throughline of the rest of this cluster.

Which contract vehicles carry VA AI dollars?

Four matter most in 2026, and they’re all awarded and usable now.

T4NG2 — Transformation Twenty-One Total Technology Next Generation 2 — is the VA’s primary IT services IDIQ. After a multi-year protest fight, a U.S. Court of Federal Claims ruling in late March 2026 cleared the vehicle to begin issuing task orders, just as the original T4NG vehicle’s ordering period winds down and a multibillion-dollar wave of legacy task orders recompetes onto T4NG2. For a new SDVOSB there is no on-ramp to prime T4NG2 — the path is teaming, and it’s unusually favorable because a verified SDVOSB subcontractor counts as a “similarly situated entity” whose workshare counts toward the prime’s self-performance floor. The full breakdown is in the T4NG2 field guide and the teaming mechanics article.

SPRUCE — the VA’s 100% SDVOSB-set-aside software and digital-services IDIQ — is the most direct vehicle for the kind of fixed-scope product work Truvisory does, covered in the SPRUCE guide. VETS 2, GSA’s SDVOSB-exclusive governmentwide acquisition contract, is a frequent VA channel and runs through February 2028. And the new Polaris SDVOSB pool, finalized in November 2025 with no master ceiling, is the long-horizon successor vehicle. How VA buys AI through each is the subject of the VETS 2 and Polaris articles.

The cleanest path of all for a first VA award skips the GWACs entirely: under the Veterans First authority, a VA CO can sole-source to a verified SDVOSB up to $5 million for services — enough for a real, deployed, 90-day AI build. The mechanics are in the VA sole-source fast lane.

What does the VA require from an AI vendor — and is CMMC one of them?

The honest answer matters here, because getting it wrong with a contracting officer is fatal: VA requires FedRAMP-aligned cloud, a VA Authority to Operate, NIST 800-53 controls, HIPAA safeguards for health data, and Section 508 accessibility — and it does not require CMMC.

VA’s standard cloud posture is the VA Enterprise Cloud (VAEC), running on AWS GovCloud and Azure Government at FedRAMP High, with an Enterprise Cloud Solutions Office process that can compress a system’s Authority to Operate to 60–90 days by inheriting controls. On top of that base sit VA Handbook 6500/6517, NIST SP 800-53, HIPAA/PHI controls for any VHA-touching system, and Section 508. The compliance hurdle for a small AI vendor is real, but it is a VA hurdle, not a defense one. The end-to-end ATO walk-through is in VA ATO + VAEC.

CMMC — the Cybersecurity Maturity Model Certification — is a Department of Defense construct under DFARS 252.204-7021. It does not appear in VA contracts. This is why Truvisory positions itself as FedRAMP-aware, not CMMC-certified: it’s the accurate posture, and on VA work it’s also the complete posture, because CMMC simply isn’t a VA requirement. Any vendor implying otherwise either doesn’t understand the VA’s stack or is misrepresenting it. The full, honest framing — and why it’s a differentiator rather than a gap — is laid out in FedRAMP-aware, not CMMC-certified.

How does a small SDVOSB actually break in?

By treating VA as a relationship market, not a search-volume market. Federal AI demand is procurement-signal-driven: the buyer usually finds you through SAM.gov, an industry day, a sources-sought response, or a prime that needs your SDVOSB status to satisfy the math — not through a Google query. That means the conversion levers are credibility artifacts, not blog traffic.

In practice, a realistic first six months looks like: establish a VA-tuned capability statement and a current SAM.gov profile (Truvisory: UEI KNZKX28MLC42, CAGE 0HPQ0, primary NAICS 541512, SBA VetCert-certified); approach the SDVOSB primes on T4NG2 and SPRUCE that need AI/automation depth; pursue at least one sources-sought response under the $5M Veterans First direct-award ceiling; and sign at least one teaming or mentor-protégé agreement before the T4NG legacy task orders finish reflowing onto T4NG2. The goal of the first award isn’t margin — it’s a VA past-performance record (CPARS), which is the credential that unlocks everything after it.

The 6–18 month forecasting workflow that surfaces these opportunities before the RFP drops is in how to forecast VA AI work. The capability statement that wins is in the SDVOSB capability statement for VA AI work.

Working with Truvisory

Truvisory builds working AI and automation for federal missions — as a fixed-scope 90-day sprint or an Embedded Fractional CTO, on a Cloudflare-native, FedRAMP-aware architecture. We’re an SBA-verified SDVOSB and we build to support your VA ATO and Handbook 6500/6517 posture — not to sell you a strategy deck.

If you’re a VA program office weighing a fast AI build, or a T4NG2/SPRUCE prime that needs SDVOSB AI depth to round out a task-order team, start with a scoping call. For the wider federal picture, see the federal AI modernization pillar.