I run a small AI startup called Xai, and we’re trying to break into federal and state government contracting. We’re struggling with registrations, compliance requirements, and figuring out which agencies actually buy AI solutions like ours. I need practical advice on how to get started, what certifications or contract vehicles matter most, and how to stand out in RFPs so we can realistically compete for AI-related government contracts.
Short version. You need three tracks in parallel: get compliant, get visible, get partners.
- Fix registrations and basics
- Register in SAM.gov. Use UEI, not DUNS. Make sure NAICS codes include AI stuff: 541511, 541512, 541513, 541519, 518210, 611420 if you do training.
- Set your business size correctly. Small business status helps a lot.
- Get SBA profile synced from SAM, then fill DSBS (Dynamic Small Business Search). Contracting officers actually search that.
- Register in state portals where you want work. Each state has its own thing. Examples: CA eProcure, Texas SmartBuy, Florida MyFloridaMarketPlace.
- Handle compliance up front
- Federal IT work now expects at least NIST SP 800-171 alignment. Start a basic SSP and POAM. Even a simple one beats “we have nothing”.
- If you touch CUI or defense, you need to prep for CMMC. Start with Level 1.
- Do security policy basics: access control, logging, MFA, encrypted storage, vendor risk. Write 1–2 page summaries.
- For AI, prepare:
• Model provenance and training data statement
• Privacy approach (PII handling, retention)
• Bias / fairness testing approach
• Human-in-the-loop description - Have a 5–10 page “Security and Responsible AI” doc you can drop into proposals.
- Find who buys AI, not everyone does
Skip the spray and pray SAM.gov search. Target agencies. Some examples that already spend on AI and ML:
- DoD and service branches (JAIC / CDAO, AFWERX, DIU, Army Futures)
- DHS (CBP, TSA, USCIS, S&T)
- HHS (NIH, CMS, CDC)
- VA (health analytics, chatbots)
- GSA (Centers of Excellence, TTS, 18F support work)
- State level: Medicaid agencies, transportation, unemployment insurance, tax agencies.
Look at usaspending.gov, search “artificial intelligence” or “machine learning”, export vendors and agencies, then study who is buying and under what NAICS and contract vehicles.
- Start with SBIR / STTR and pilot programs
- Check DoD SBIR, DHS SBIR, NSF, NIH. AI topics show up all the time. Easier entry than full and open RFPs.
- Look at AFWERX, DIU solicitations. They like AI use cases.
- Some states have innovation challenges or “pitch days” for AI or data analytics. That gives you references and proof.
- Do not go prime first, go subcontract
- Identify 5–10 mid tier integrators in AI and analytics. Examples: Booz Allen, SAIC, Leidos, CACI, General Dynamics IT, Guidehouse, small primes like Octo, ECS, Excella, etc.
- Use usaspending.gov to see who already won AI-ish work with your target agency.
- Message their BD folks with specific ask:
• “We do X for Y use case”
• 2–3 bullets of technical edge
• Short paragraph on compliance posture
Offer to white label your AI or be the specialist on their bids. Your first revenue likely comes as a subcontractor.
- Tune your AI offering to government problems
Nobody buys “generic AI platform”. They buy things like:
- “Triage citizen emails for Agency Z”
- “Fraud detection for Medicaid claims”
- “Predictive maintenance for fleet”
- “Document summarization for case workers”
Pick 1–2 niches. Build small demo sets with synthetic or public data. Then show a clickthrough demo, not a slide.
- Learn the buying lingo
- RFI, RFP, RFQ, Sources Sought. Respond to Sources Sought, even if rough. That gets you on radars.
- IDIQ, BPA, GWAC. You likely join these through partners at first.
- Set-asides: Small Business, 8a, HUBZone, WOSB, SDVOSB. If you have any, that helps. If not, partner with firms that do.
- Simple process for you this quarter
Week 1–2
- Finish SAM, DSBS, pick NAICS.
- Draft 2 pager: “Xai AI for [specific use case]”.
- Draft basic security and AI governance summary.
Week 3–4
- Identify 2–3 target agencies and 10 primes that work with them.
- Reach out to primes, ask for meetings, bring demo.
Month 2–3
- Respond to at least 3 Sources Sought or RFIs. Even if imperfect.
- Submit at least 1 SBIR or similar small grant if cycle fits.
- Join 1–2 industry days or virtual events for target agencies, ask direct questions in Q&A.
Stuff most small AI shops mess up
- Sell “AI” as the product instead of outcome.
- Ignore security and compliance until a CO asks.
- Try to own the whole contract instead of subcontracting.
- Send generic BD emails with no specific use case.
If you tighten scope, speak agency language, and show you are not a security headache, you win deals faster.
You’re already ahead by even asking this instead of just shotgunning SAM.gov bids.
@jeff covered the classic BD and compliance track. I’ll try not to rehash that and focus on stuff most AI startups miss when they go gov.
1. Stop selling “AI” and start selling boring operational painkillers
Gov buyers don’t care that you do LLMs, RAG, or “cutting edge transformers.” They care that:
- Their case workers are drowning in PDFs
- Their call center metrics are red
- Their fraud team is 18 months behind on leads
- Their leadership keeps getting yelled at by OIG / GAO
Take 2 or 3 very specific pains and make those your gov story. Example:
- “We cut time to review benefits appeals by 30% using document triage + summarization.”
- “We reduce low value human review of claims by auto-tagging 70% of them as low risk.”
Then build a 5–10 minute click demo around exactly that, with public or synthetic data that looks like their world:
- Use fake Medicaid forms, fake FOIA requests, fake citizen emails
- Show before / after: what a worker does now vs with your tool
If your current pitch deck still says “platform,” “ecosystem,” or “end-to-end AI,” burn it for gov. Make it “AI co-pilot for [very specific worker type] at [type of agency].”
2. Build your “gov shelf product,” even if under the hood it’s custom
One of the fastest hacks to credibility: act like you already have a product used by agencies, even if under the hood you are wiring things manually at first.
Create:
- A named offering: “Xai CaseAssist for Benefits & Claims” or similar
- A 1-page “product sheet” with:
- Problem
- How it works in 3 bullets
- Security / privacy statement in 3 bullets
- Implementation timeline (pilot in 6–8 weeks)
- Rough price structure (per-seat / per-usage, even if negotiable)
Gov folks like to buy “things” more than “consulting of mysterious nature.” You can still do custom stuff, but having a clear repeatable offer makes primes and COs more comfortable.
I partially disagree with @jeff on one subtle point: he leans heavily on “start as subcontractor” (true generally), but if you create a very narrow, low-dollar “productized pilot,” you can sometimes win as a prime on micro-purchases or small pilots, especially at state / local or via innovation programs.
Target: 25k to 150k pilots with very clear scope:
- 1 use case
- 1 or 2 departments
- 8–12 weeks
- Clear success metric (e.g., “cut average handling time by 15% in 3 months”)
3. Turn compliance from a weakness into a sales weapon
You’re struggling with compliance. Fine. Use that to your advantage by being weirdly transparent.
Most small AI shops mumble hand‑wavey stuff like “we use industry best practices.” Don’t.
Instead, do this:
- List the 5 biggest things you don’t do yet, and how you plan to close them
- Show a simple roadmap: “Current security / privacy posture vs 6-month target”
- For AI specifically, prepare 1-page docs on:
- Data residency and storage: where is training / inference data stored, how long, how isolated
- Human review: what decisions are never fully automated
- Redress: if the model screws up, how does a citizen / worker fix it
- Model update policy: how often, how changes are tested
You will look much more mature than larger vendors that say “proprietary magic.” In Q&A, you can actually lean into: “We’re small, but that lets us adapt controls faster around your specific risk posture.”
4. Learn to reverse engineer a specific agency
Instead of “which agencies buy AI,” pick one agency and go deep for 30 days. You will learn patterns you can re-use everywhere.
Simple flow:
- Go to usaspending.gov and search that agency + NAICS codes @jeff mentioned.
- Filter for keywords in award descriptions: “analytics,” “algorithm,” “natural language,” “machine learning,” “chatbot,” “data science.”
- Pick 5 actual awards and read:
- Who won
- Award amount
- Period of performance
- Contract vehicle
Now do 2 things that most startups never bother with:
- Read the IG and GAO reports for that agency from the last 2–3 years. Pain list is right there: backlogs, system failures, fraud problems, customer service nightmares. Build use cases that map 1:1 to those pain bullets.
- Watch or skim appropriations hearings and oversight hearings on YouTube or written testimony. When a Senator publicly grills an agency head about some backlog, you just found a high-level “sponsor” for the kind of solution you offer.
That gives you specific language to use in every convo:
“Your IG highlighted X backlog in the 2023 report; our solution directly targets [that thing].”
5. Change your outbound from “salesy” to “help a PM not get fired”
When you talk to program managers / product owners / data leads, they’re not thinking “innovation,” they’re thinking:
- “My backlog makes me look bad.”
- “We’ll get audited and I’ll spend 6 months in meetings.”
- “I can’t hire enough analysts / case workers.”
Structure your outreach like this:
- 2 sentences: specific pain you think they have, tied to something public (OIG report, RFP history, backlog stats from hearing)
- 3 bullets: what you’ve actually done that is analogous (even if in private sector)
- 1 offer: 30–45 minute working session where you show their workflow, mapped, then a demo
You’re not selling “AI,” you’re offering to help them not be the subject of the next oversight hearing.
6. Use one or two agencies as your “lab,” not your cash cow
Early on, your first gov contracts probably will not be profitable if you account for your engineering time honestly. That’s fine if you treat them as:
- Product design partners
- Credibility builders
- Reference creators
Avoid the trap of customizing yourself to death. For each new “feature” they want, ask:
“Would at least 3 other agencies want this?”
If no, push to keep it as config or optional service, not core product.
Your goal: 2 or 3 early gov customers that you can reference and then reuse 80% of the solution elsewhere.
7. Use AI to fight the RFP beast
Everyone complains about how painful proposals are. You’re literally an AI company. Eat your own dog food.
- Fine-tune or at least prompt a model on:
- Federal boilerplate, FAR / agency clauses
- Your own past proposals, security docs, bios, tech stack descriptions
Use it to draft:
- First-cut responses to RFIs / Sources Sought
- Security and tech volumes that you then hard-edit
- Compliance matrices
You still need manual review (obviously), but your ability to respond to 3–5 times more opportunities with decent quality is a legit edge over other tiny vendors that write everything from scratch.
I actually mildly disagree with one implicit assumption in @jeff’s post: that you should respond to a small number of RFIs. Early on, if you can semi-automate the grind, I’d respond to more as long as each one is targeted and doesn’t blow your week.
8. Don’t forget state & local as a parallel path
You mentioned state too. Federal is slow, state can be chaotic but sometimes faster:
- City 311 systems drowning in tickets
- State unemployment insurance with massive backlogs
- Transportation departments that can’t manage work orders or inspection reports
Many states are way more flexible with pilots, SaaS, and even procurement workarounds like “creative use” of existing vehicles. Also, some are more forgiving if you’re early stage as long as security looks sane.
Find 1 or 2 states where:
- You have any relationships at all
- Their IT / innovation office actually publishes “data / AI / modernization” roadmaps
Start with a pilot in a non-mission-critical area so they’re not terrified of risk.
If you stack all of this on top of what @jeff laid out, your plan roughly becomes:
- He covers: registrations, baselines, primes, vehicles.
- You add: ultra-specific use cases, agency-deep dives, productization, transparent compliance, and faster proposal throughput using your own tech.
Gov customers do buy AI. They just almost never buy it labeled as “AI.” They buy “less backlog,” “fewer errors,” and “less embarrassment in front of Congress.” Align to that and everything else gets a lot less painful.