VA Document Automation with AI: The SDVOSB Capability Play

How big is the VA’s document problem, really?

Big enough that the VA is publishing the numbers itself. On the health side, VHA’s April 2026 announcement of AIEFF states the agency receives more than 13 million electronic faxes a year from community-care providers, each of which a staff member previously had to open, read, rename, and route by hand — “labor intensive, time consuming and error prone, creating backlogs, staff burnout and overtime costs.” The VA Inspector General quantified the downstream cost: of nearly 3 million community-care consults closed in a recent period, almost a million were administratively closed, partly because records didn’t make it into the chart in time, and the OIG recommended the VA expand technology to cut the manual renaming and uploading.

On the benefits side, the VBA processed a record 3,001,734 disability and pension claims in FY2025, and on February 26, 2026 announced the disability backlog had fallen below 100,000 for the first time since 2020 — roughly 96,000, down from 264,717 in January 2025, a 63% drop, with average days-to-complete falling from 141.5 to 80.7. The VA credits a mix of hiring, overtime, and AI — chiefly Automated Decision Support (ADS), which uses machine learning and OCR/NLP to pull structured evidence out of the claims folder for a human rater to decide on. And the portfolio is concentrated here: the VA’s 2025 AI use-case inventory lists 367 use cases, 138 active, with 28 specifically in benefits processing and many more document-adjacent. This is where the money is going, too — the FY27 budget proposes $47.8M for “Decision Intelligence and Automation” and a separate $130M for VBA claims-processing AI.

What does “document automation AI” actually mean for VA work?

It’s a four-stage pipeline, and naming the stages is how you show a buyer you understand the work rather than just the buzzword.

First, ingest and OCR: fax-quality scans, handwritten clinician notes, and forms get turned into machine-readable text. Modern OCR hits 98–99% on clean print but degrades on low-DPI faxes and handwriting, which is where layout-aware and vision-language models earn their keep — and where they introduce hallucination risk a human has to catch. Second, classify and route: deciding whether a fax is a discharge summary, an imaging report, or a referral, which Veteran’s chart it belongs in, and which queue it goes to — exactly the step AIEFF automates. Third, extract and validate: pulling the Veteran identifier, diagnostic codes, dates, and provider details, then checking them against the system of record. Fourth, summarize and retrieve: RAG over the claims folder to produce evidence summaries and draft memos — always for human review, never as the final decision.

That last clause isn’t a disclaimer; it’s the design constraint. Any document system that affects a benefits or clinical decision is “high-impact AI” under OMB M-25-21, which means mandatory human oversight, pre-deployment testing, impact assessment, and ongoing monitoring. The right pitch is never “we replace the reviewer.” It’s “we cut the reviewer’s per-document time by 30%+ while preserving the audit trail” — which is precisely what AIEFF demonstrated.

On the architecture, with an honest caveat. A Cloudflare-native build maps the pipeline cleanly — R2 for document storage, Workers for OCR/classification/extraction, Vectorize for RAG, D1 for case state, Queues for batch processing, Durable Objects for per-document orchestration. But here’s the compliance truth most vendors gloss: Cloudflare for Government is FedRAMP Moderate-authorized, with FedRAMP High still “In Process,” while the VA Enterprise Cloud requires FedRAMP High for systems handling sensitive VA data. So a Cloudflare-native delivery for a VA document pilot takes one of three honest shapes: the sensitive workloads run inside the VA’s FedRAMP High boundary (AWS GovCloud or Azure Government) with Cloudflare handling non-sensitive edge functions; or the pilot is scoped to a non-sensitive workflow where Moderate suffices; or it processes only data whose classification supports Moderate. Truvisory builds to FedRAMP control families and VA Handbook 6500/6517 from day one — FedRAMP-aware, not claiming a posture it doesn’t hold. (More on that distinction in FedRAMP-aware, not CMMC-certified.)

How is this work actually being contracted?

Through the same three lanes the rest of this cluster maps — and the awards are already on the board.

(Compiled from SAM.gov / USAspending and award coverage.)

The pattern is clear. The $5M sole-source lane under 38 U.S.C. § 8127(c) is the fastest path to first revenue — PingWind and Huntridge both landed benefits-intake document work that way in September 2025. The SPRUCE and T4NG2 IDIQs carry the larger forms-modernization task orders, reachable for a non-prime through similarly-situated subcontracting. And the AI Tech Sprint follow-on lane — the one Abridge used — has a dedicated Community Care Document Processing track whose production awards are a 2026 watch item.

The best-fit NAICS is 541512 (computer systems design, $34M size standard) for end-to-end pipeline delivery, with 541511 (custom programming) and 541519 (other computer services — the code used on the Aquia Nava II task) as alternates. Avoid 561410/561499 (document-prep/business-support) — those read as staff augmentation, not AI.

What does a realistic engagement look like?

Bounded and fixed-price, sized to the lane.

• 90-day discovery/pilot, $200K–$750K — one workflow (a single fax-classification queue, one form’s intake), a measured baseline, human-in-the-loop QA, designed to fit inside the VA’s 60-day accelerated AI ATO.
• 6–12 month build under § 8127(c), $1M–$4M — the full pipeline plus the ATO package, the M-25-21 impact assessment, training, and runbooks.
• Similarly-situated subcontract on a SPRUCE/T4NG2 document task order, $500K–$5M of allocated SDVOSB scope.
• Tech Sprint entry — near-zero-cost option on a follow-on award (Abridge’s ~$5.37M is the recent benchmark).

What about compliance — the documents are full of PHI?

They are, and this is where credibility is won or lost. A single community-care fax can carry a Veteran’s SSN, a substance-use diagnosis, an HIV result, and a sickle-cell treatment plan. HIPAA applies; so does 38 U.S.C. § 5701 (claimant confidentiality); and so does 38 U.S.C. § 7332, which puts a statutory consent gate on drug/alcohol/HIV/sickle-cell records and carries criminal penalties — up to $5,000 first offense, $20,000 after. An IDP system has to detect and tag § 7332-protected content, restrict logging and model training on it, and keep an auditable disclosure trail.

The hosting and governance bar is equally defined: a VA ATO under Handbook 6500/6517, hosted in the VA Enterprise Cloud at FedRAMP High (AWS GovCloud or Azure Government), with the VA’s 60-day accelerated AI ATO pathway as the operational hook that makes a 90-day pilot feasible. Plus the seven M-25-21 high-impact practices, plus Section 508 on anything a human sees. A vendor who arrives with a draft impact assessment, a model card, and a monitoring plan is materially more credible than one who doesn’t. And to be plain: CMMC is a DoD program and does not apply to VA work — leading with it on a VA proposal signals unfamiliarity, not strength.

Working with Truvisory

Truvisory is an SBA-verified SDVOSB founded by a combat veteran, building working document-automation AI — OCR, classification, extraction, summarization, RAG — on a Cloudflare-native, FedRAMP-aware architecture, fixed-scope, in 90 days, human-in-the-loop by design.

If you’re a VHA Community Care or VBA program manager with a document backlog, we can scope a single-workflow pilot with a measured baseline, an M-25-21 impact assessment, and an accelerated-ATO package as deliverables — AIEFF’s 31% is the bar. Book a scoping call. For the procurement path, see the $5M sole-source guide and the VA AI modernization pillar.