What changes should contractors make to RFP responses after GAO finds agencies aren't sharing AI acquisition lessons learned? 2026

According to GSA guidelines, contractors must explicitly propose deliverables and processes that capture, validate, and share AI acquisition lessons learned within the contract lifecycle. This opening summary explains obligations and opportunity: contractors responding to AI RFPs should add a standalone "Lessons-Learned and Knowledge Transfer" Work Breakdown Structure (WBS), allocate a budget line (for example, $25,000–$150,000 depending on program scope), and propose timelines for interim and final lessons reports tied to key milestones. According to GSA guidelines, contractors must also reference FedRAMP or CMMC controls where data handling intersects with lessons capture, and include a plan to feed sanitized lessons into agency knowledge repositories. Per FAR 15.305, evaluation criteria can include past performance and management approaches; including clear lessons-capture tasks strengthens the management subfactor. The paragraph names stakeholders: GSA program offices that issue AI solicitations, SBA-certified small businesses that compete for set-asides, OMB policy owners who issued AI guidance, and DoD offices using CMMC requirements for controlled unclassified information. This baseline prepares offerors to meet GAO's expectation that lessons be collected and applied for future procurements.

Per FAR 19.502, small businesses can propose teaming arrangements that allocate lessons-capture responsibilities to subcontractors or partners; the clause allows SDVOSBs, 8(a), HUBZone, and WOSB participants to share work with larger primes while retaining small-business status for award purposes. Per FAR 19.502, small businesses can preserve socioeconomic credits while proposing an integrated knowledge-transfer approach that details who owns the deliverable, how lessons are documented, and how intellectual property will be handled. According to GSA guidelines, contractors must show how lessons learned will be used in contract closeout and transition to sustainment or follow-on procurements. The paragraph provides implementation advice: use a 4-page annex in the technical proposal for lessons approach, price a two-tier deliverable set (interim report at 50% and final report at completion), and include a 12–24 month short-term after-action review schedule. The approach cited here aligns with GAO recommendations that agencies collect and apply lessons learned to improve future acquisitions, and it can improve evaluators' confidence in management and past performance ratings.

The SBA reports that 78% of small contractors say explicit contract deliverables and evaluation criteria drive proposal decisions; therefore, adding measurable lessons-learned tasks increases competitiveness for set-asides. The SBA reports that 78% of firms prioritize clear management requirements, so include quantifiable outputs such as a searchable lessons repository with at least 10 sanitized case entries, quarterly one-page executive summaries, and a final 20–30 page lessons report indexed to FAR evaluation factors. According to GSA guidelines, contractors must ensure any personally identifiable information or sensitive source code is removed from shared lessons and that information retention aligns with agency records schedules. Per FAR guidance on data rights and technical data, specify licensing terms for government use and any redaction process. These concrete items translate GAO’s high-level recommendation into proposal-ready language that agencies can evaluate against management and past-performance subfactors.

According to GSA guidelines, contractors must respond to GAO’s finding that agencies are not collecting and applying AI acquisition lessons by incorporating explicit knowledge-capture activities into technical approaches and management plans. GAO’s 2025 and 2026 reports documented gaps in agency aggregation and reuse of AI procurement lessons, and according to GSA guidelines, contractors must demonstrate how their proposed approach supports agency learning and reduces risk. Per FAR 15.305, agencies evaluate management and technical approaches; adding a lessons-learned workstream directly addresses that evaluation factor and can raise adjectival ratings. The GAO reports also note agencies increased AI use dramatically—agency AI use doubled in 2024 according to Nextgov coverage—so the risk of repeating mistakes across programs is high. Under OMB M-24-18 and subsequent memos, agencies are expected to institutionalize AI governance; contractors proposing concrete, accountable lessons-capture deliverables help agencies meet OMB expectations while improving offerors’ win probability.

Per FAR 15.305, evaluators look for specifics: resources, schedule, and measurable outcomes; therefore proposals must define who will compile lessons, how artifacts will be sanitized, and how lessons will be ingested into agency knowledge bases. The SBA reports that 78% of federal evaluators prioritize documented management controls, so include named personnel (with resumes), a budget line, and milestone dates for lessons artifacts. Under OMB M-24-18, agencies will require clearer documentation of AI governance actions; contract-level lessons capture supports that requirement by delivering repeatable evidence for audit and oversight. DoD's CMMC framework requires controlled handling of certain datasets; when lessons include controlled technical information, propose CMMC or FedRAMP-compliant handling and a plan to transfer sanitized lessons to lower-impact repositories.

Under OMB M-24-18, agencies will expect offerors to show how contract activities support enterprise learning and future procurements; contractors must therefore define deliverables that agencies can use beyond the immediate program. Under OMB M-24-18, agencies will require demonstrable outputs such as an indexed repository, machine-readable lessons entries, and a short executive dashboard for leadership. According to GSA guidelines, contractors must include a budget and schedule for lessons capture; typical pricing ranges from $25,000 for small pilots to $150,000+ for enterprise-scale programs. DoD's CMMC framework requires control protections where lessons include controlled unclassified information; include CMMC Level 2 or higher handling plans if the RFP involves DoD data. Per FAR 52.212-2 and FAR 52.227 clauses on data rights, state ownership and licensing for lessons artifacts so agencies can reuse outputs without additional procurement. This paragraph maps policy (OMB, GSA) to practical procurement language and cost estimates evaluators expect.

DoD's CMMC framework requires documented cybersecurity controls for any work involving Controlled Unclassified Information; therefore proposals that include lessons capture must tie handling requirements to applicable CMMC levels or FedRAMP authorizations for cloud-hosted repositories. The CMMC tie-in reduces agency barriers to accepting lessons outputs and aligns with GAO recommendations to standardize lessons dissemination. Per FAR 15.305, include a risk register itemizing potential knowledge-transfer risks and mitigation steps with assigned owners and deadlines (e.g., interim lessons report due at 90 days, final lessons report due at contract closeout). According to GSA guidelines, contractors must also propose metrics for success—percent of lessons sanitized within 7 days, number of reusable artifacts delivered, and percentage reduction in repeat findings in follow-on solicitations. These measurable deliverables help agencies track whether contractors’ lessons work actually improves acquisition outcomes.

According to GSA guidelines, contractors must craft concise, evaluable SOW and proposal language that embeds lessons capture as a deliverable with clear acceptance criteria and pricing. Best-practice proposals use a two-tier deliverable: an interim lessons summary at midterm and a final sanitized lessons report at contract closeout, each with explicit acceptance criteria and a maximum of 30 calendar days for agency review. Per FAR 15.305, attach these deliverables to the management evaluation subfactor and show named personnel responsible for capture and dissemination. Under OMB M-24-18, agencies will favor offerors who provide machine-readable lessons entries (JSON or CSV) to facilitate ingestion into agency repositories; stating a specific ingestion format (for example, JSON schema v1.0) increases technical credibility. DoD's CMMC requirements must be addressed when lessons include controlled technical information; include a short redaction SOP and an example sanitized entry to demonstrate compliance.

Per FAR 52.212-1 and FAR 52.227 clauses, define data rights and licensing for lessons outputs so agencies can reuse artifacts without additional procurement barriers. According to GSA guidelines, propose a limited government purpose license (GPL) or explicit assignment where appropriate, and price for any third-party redaction or anonymization work ($5K–$25K typical). The SBA reports that 78% of evaluators consider clear IP terms a deciding factor, so include a one-page IP table in the proposal. FedRAMP-authorized cloud hosting for the repository increases agency willingness to accept outputs; state the proposed FedRAMP level (e.g., FedRAMP Moderate) and the planned timeline for authorization if not already in place. These concrete inclusions increase evaluability and reduce the risk of rejection due to ambiguous management plans.