What Phase III is
Phase III is not a funding program. There is no Phase III solicitation, no Phase III appropriation, and no Phase III office. It is a legal status that attaches to work when that work derives from, extends, or completes an effort made under a prior SBIR or STTR funding agreement, and is paid for with money from outside the SBIR and STTR set-aside. The SBA Policy Directive effective May 3, 2023 defines it exactly that way at section 4(c), and lists three qualifying shapes: commercial application financed by non-federal capital, SBIR-derived products or services bought by the government with non-SBIR federal money, and continuation of the earlier research with non-SBIR federal money.
Everything that makes Phase III interesting follows from that status. The Policy Directive states plainly that there is no limit on the number, duration, type, or dollar value of Phase III awards, and no limit on the time that may elapse between the earlier phase and the Phase III, or between one Phase III and the next. Small business size limits stop applying. A subcontract under a federally funded prime contract can itself be a Phase III award.
A buyer meeting this for the first time usually asks the wrong question. The question is not "how do we set up a Phase III." It is "does the work we want to buy derive from something this company already built under an SBIR award." If the answer is yes, the status exists whether or not anyone writes it down. If the answer is no, no amount of paperwork creates it.
The paragraph that does the work
The authority is 15 U.S.C. § 638(r)(4). It directs federal agencies and federal prime contractors, to the greatest extent practicable, to do two things: consider an award under the SBIR or STTR program to satisfy the competition requirements of 10 U.S.C. §§ 3201 through 3205, and issue Phase III awards relating to the technology, including sole source awards, to the SBIR and STTR recipients that developed it.
Read the first half carefully, because it is the whole trick. The competition that already happened, when the company won Phase I or Phase II against a field, is treated as the competition for the follow-on. The Policy Directive spells out the consequence: those earlier competitions satisfy any competition requirement of the Armed Services Procurement Act, the Federal Property and Administrative Services Act, and the Competition in Contracting Act, so an agency funding a Phase III "is not required to conduct another competition for the Phase III award in order to satisfy those statutory provisions."
This is not an exception carved into the competition rules. It is a finding that the rules were already met, years earlier, by a different competition. That distinction matters when a contracting officer starts pattern-matching the request against ordinary sole-source procedure and reaches for a thick justification package.
How strongly a fact pattern supports the derivation finding
Editorial weighting of how well each pattern maps to the statutory phrase, read against the Policy Directive and the decisions discussed below. Judgement, not measurement.
The justification that is one paragraph long
Both the Policy Directive and the Department of Energy's Phase III guidance say the same thing, in nearly the same words. In conducting actions relative to a Phase III award, it is sufficient to state, for purposes of a justification and approval if the agency deems one required, that the project is an SBIR or STTR Phase III award derived from, extending, or completing efforts made under prior funding agreements, and is authorized pursuant to 15 U.S.C. 638(r)(4). DOE adds four words that a program office should read out loud: "Further justification is not needed."
NASA's own external Phase III guide is more direct still. It tells companies that if a technical point of contact mentions a justification for other than full and open competition, they can reply that one is not required, and it prints a one-page template in the appendix. That template is worth studying for a reason its authors did not intend: its authority citations refer to Title 10 and Title 41 sections that predate the recodifications those titles have since undergone. Agency Phase III paperwork is often old paperwork.
On the FAR side, the citation practitioners reach for is FAR 6.302-5, "authorized or required by statute," whose own authority citations are 10 U.S.C. 3204(a)(5) and 41 U.S.C. 3304(a)(5). The enumerated list at FAR 6.302-5(b) does not name SBIR. It covers Federal Prison Industries, the nonprofit agencies for the blind and severely disabled, government printing, and the 8(a), HUBZone, veteran-owned and women-owned sole source programs. The SBIR hook is the operative language itself, that a statute expressly authorizes acquisition from a specified source, and 15 U.S.C. § 638(r)(4) is that statute. A contracting officer who searches the (b) list for the word SBIR, finds nothing, and concludes the authority does not exist has made a reading error that costs real programs real months.
"Derives from, extends, or completes" is the whole test
Everything turns on that phrase, and there is a controlling public reading of it. In Toyon Research Corporation, B-409765 (Aug. 5, 2014), GAO addressed an Army competition that a prior SBIR performer said should have been its Phase III. GAO set out the standard cleanly: "Standing alone, the fact that two sequentially issued solicitations share the same set of specifications and requirements does not demonstrate that the second solicitation derives from, extends, or completes the effort of the first." The test is whether the later requirement is refined by incorporating original concepts, findings, ideas, or research results the contractor generated through performance.
Toyon lost on those facts because the agency had envisioned the technical approach from the beginning; the company had shown feasibility, but had not shown that the new requirement carried Toyon-specific innovation rather than the general concept. The lesson runs in both directions. A company whose Phase II merely executed a government-authored specification has a weak derivation case. A company whose deliverables changed what the government thinks the requirement is has a strong one.
A more recent decision draws the outer boundary. In Inkit Inc., B-423724 (Sept. 9, 2025), a prior SBIR performer argued the Army should have pursued Phase III instead of buying commercial software licenses through an enterprise agreement. GAO found the protest failed to establish that the purchase reflected the Army's pursuit of technology developed under the company's earlier awards. Phase III obligations attach when an agency goes after the thing the company built. They do not attach to every adjacent purchase in the same product category.
Who is allowed to receive one
The recipient has to be the company that developed the technology, or a genuine continuation of it. Policy Directive section 6(a)(5) allows a Phase III awardee to be a company that received a prior Phase I or Phase II award, was novated one, received a revised award, is a successor in interest, or simply reorganized with the same key staff, a partnership becoming an LLC, even under a different tax identification number.
The limit is real, and GAO has enforced it. In ASRC Federal Data Network Technologies, LLC, B-418028, B-418028.2 (Dec. 26, 2019), GAO sustained a protest against a Defense Health Agency Phase III award because the awardee had been novated only a prior Phase III contract, never the underlying Phase I or Phase II. Buying a company that once performed the earlier phases was not enough. The chain of title has to run back to the original award.
On the other side, the pool of possible buyers is wide. Any federal agency can award a Phase III regardless of which agency funded the earlier phases, a point NASA states without qualification: a NASA Phase III can rest on a Department of Defense or NOAA Phase II, and the reverse. Government-owned contractor-operated laboratories and federally funded research and development centers are named in the same breath. And the statute reaches federal prime contractors, which is why a subcontract can carry Phase III status.
Phase III preference is not a claim on every competition
DOE's guidance states the boundary directly: the preference applies when the government is seeking the specific technology developed under a prior SBIR or STTR award. It does not require an agency to issue a Phase III when it runs a competitive solicitation that does not specify a technical solution previously developed under the program. Combined with Toyon and Inkit, that leaves a narrow, defensible lane rather than a general right of first refusal.
The preference is a duty with a procedure attached
Most published summaries stop at "agencies may sole source." The Policy Directive is considerably more demanding than that. Section 4(c)(7) calls it a special acquisition requirement, and its implementation instructions read like a checklist a program office can be held to.
The agency must make a good faith effort to negotiate with the awardee about the new, related work. It must evaluate the work against its documented mission requirements. It must consider the practicality of a direct follow-on by performing market research to determine whether the company is available, capable, and willing. And then the language turns mandatory: "If pursuing the Phase III work with the Awardee is found to be practicable, the agency must award a non-competitive contract to the firm."
If the agency decides otherwise, it does not simply move on. It documents the file, sends the decision and the rationale to SBA, and notifies SBA in writing before making an award to anyone else, including the steps it took, the reasons a follow-on with the awardee is not practicable, and the identity, vehicle type, and value of the intended alternative award. From there an appeal ladder with fixed clocks opens.
The SBA appeal ladder, Policy Directive § 4(c)(7)
Two features of this ladder deserve attention on the buy side. SBA can start it at any time when it believes an agency is pursuing Phase III work without having complied with the notice requirements, and it makes that determination on all information it receives, including information brought to it directly by the company. SBA also reports to Congress every instance in which an agency pursued Phase III work with someone other than the original awardee. This is an accountability mechanism with a reporting tail, not a suggestion.
Data rights are why a Phase III sticks
The commercial logic of Phase III rests on data rights, and the numbers here have moved recently enough that stale advice is common.
A Phase III award is by its nature an SBIR or STTR award. It carries SBIR/STTR status and must include SBIR/STTR data rights. The protection period begins at award of a funding agreement, Phase I, Phase II, or a federally funded Phase III, and runs twenty years, or longer at the participating agency's discretion, unless the agency and the company negotiate otherwise after award. Data generated during Phase III work starts its own clock at the Phase III award date.
During that period the government may use and modify the data inside the government but may not release it outside for procurement, manufacture, or commercial purposes without written permission, and releases to support contractors require a non-disclosure agreement meeting the Policy Directive's terms. That restriction is the practical engine of the whole authority. An agency that wanted to recompete the work would have to do it without handing anyone the technical baseline.
On the defense side, DFARS 252.227-7018 now carries an AUG 2025 date, following the final rule effective January 17, 2025 that replaced the old five-year, indefinitely extendable period with a single twenty-year period. The trade in that rule is easy to miss: when the protection period ends, the government now takes perpetual government purpose rights rather than unlimited rights. DFARS 227.7104-2 states it directly, and adds that the government "shall not make contract award conditional on the contractor or subcontractor negotiating or consenting to negotiate special license rights."
Civilian-side paperwork has not kept pace. FAR 52.227-20, "Rights in Data—SBIR Program," still specifies four years after acceptance of deliverables and points to an extension procedure at FAR 27.409(h) referencing a Policy Directive from 2002. The SBA directive is the instrument that sets the protection period, so the twenty-year period governs. A company signing a civilian agency contract that carries the older clause text should raise it before award rather than after.
Phase III against the alternatives
| Axis | SBIR Phase III | New competitive FAR award | Prototype OT, 10 U.S.C. 4022 |
|---|---|---|---|
| Basis for skipping competition | The Phase I or II competition already satisfied the requirement; 15 U.S.C. 638(r)(4) | None; competition is the process | Not a procurement contract, so the FAR competition rules do not apply on their own terms |
| Documentation burden | A short derivation statement; the Policy Directive says further justification is not needed | Full solicitation, evaluation record, and source selection documentation | Negotiated agreement written close to a blank page |
| Who may receive it | Only the developing company or a novated or successor entity in the chain of title | Any responsible offeror | Any participant that satisfies one of the statutory conditions |
| Ceiling and duration | No limit on number, duration, type, or dollar value; no time limit between phases | Set by the solicitation and the vehicle | Set by the agreement; production follow-on possible |
| Data rights posture | SBIR/STTR data rights attach by status, 20-year protection period, carried into the new award | DFARS or FAR defaults keyed to who funded development | Whatever the agreement says |
| Objection surface | GAO declines review of a decision not to award; the Court of Federal Claims has taken jurisdiction on the right facts | Full GAO and court protest rights, stay available | GAO generally declines the award itself |
What can actually be protested
The forum picture is lopsided, and understanding it is most of the risk assessment.
GAO will not review an agency's decision not to enter into a non-competitive Phase III agreement. That is Complere Inc., B-406553 (June 25, 2012), where a NASA Phase II performer submitted an unsolicited Phase III proposal, NASA declined, and GAO held the decision outside its review. So the company that believes it was owed a Phase III has historically had no cheap forum.
GAO will take the adjacent questions. Toyon proceeded because the agency was running a competitive procurement with non-SBIR funds, which GAO said its Complere holding did not touch. ASRC was sustained on eligibility. The pattern is consistent: GAO reviews whether a Phase III award went to a company entitled to receive one, and whether a competition was properly conducted, but not the discretionary judgement to forgo a Phase III.
That picture shifted this summer. In Strategi Consulting, LLC v. United States, No. 26-450, the Court of Federal Claims issued an opinion on July 24, 2026 denying the government's motion to dismiss a protest brought by a Space Systems Command Phase II awardee who alleged the government declined its Phase III and routed derived follow-on work to other contractors holding existing task orders. The court treated informal in-sourcing and de facto follow-on work as a procurement, read the FASA task order bar narrowly, and accepted that the Phase III preference statute can support injunctive and declaratory relief.
Read it for what it is: a jurisdictional ruling on a motion to dismiss, not a merits decision, and one trial-level opinion does not remake the landscape. But it opens a door Complere had left closed for fourteen years, and it should change how a program office documents a decision to buy derived work from someone else.
What the 2026 reauthorization changed
SBIR and STTR authority lapsed on September 30, 2025 and was restored by the Small Business Innovation and Economic Security Act, Public Law 119-83, signed April 13, 2026, which extends the programs through September 30, 2031. Three of its sections bear directly on Phase III, and all three point the same way.
Section 5, Phase III award education. A new 15 U.S.C. § 638(r)(5) requires SBA, coordinating with the Secretary of Defense and the Administrator of General Services, to establish training for contracting officers and the agency acquisition workforce covering the missions and authorities of the programs, the use of Phase III agreements, Phase III data rights, and "the execution of Phase III sole source award contracts." Congress named the exact failure mode: the people who sign these awards did not know how.
Section 6, Phase III improvements. Procurement center representatives are now directed to advocate for the maximum practicable use and transition of SBIR and STTR technology to Phase III, and SBA has one year from enactment to modify its policy directives accordingly. Section 638(r)(4) itself gained two new subparagraphs requiring agencies to develop simplified and standardized procedures and model contracts for Phase I, II, and III awards, and to issue standardized solicitation provisions and clauses telling companies what they will be expected to provide to establish Phase III eligibility.
Section 8, data collection. GSA must update the Federal Procurement Data System to flag whether an award is a Phase III prime contract or subcontract, whether non-SBIR contracts use SBIR or STTR funded technology, and to require a contracting officer recording a follow-on contract to reference the prior SBIR or STTR contract identification number.
That last item answers a question buyers ask early and deserve a straight answer on. Reliable government-wide totals for Phase III volume are not published, because until this law the data was not systematically captured. Anyone quoting a precise annual Phase III figure is extrapolating. The honest statement is that the flagging requirement exists in the 2026 statute precisely because the number was not knowable before, and it will be a few reporting cycles before it is.
Practical reading for the buy side
Find the derivation before you find the vehicle. Write two paragraphs naming the prior award numbers and the specific concepts, findings, code, models, or results the new requirement depends on. If those paragraphs are hard to write, the status probably is not there, and Toyon explains why sharing a specification is not enough.
Check the chain of title early. If the company has been acquired, merged, or restructured, confirm the Phase I or Phase II award itself was novated or the entity is a genuine successor. ASRC is what happens when that check is skipped.
Settle data rights before award. Confirm which clause is in the contract, the twenty-year period, and the marking legend. Special licenses may be negotiated only after award and only voluntarily, and a solicitation provision that would shrink the rights has no effect on the resulting award.
Document the alternative honestly. Buying derived work from someone other than the originating company requires a written notice to SBA before award, and Strategi is a live reminder that an undocumented route around the preference now has somewhere to be litigated.
Expect the paperwork to be older than the rule. Templates, desk references, and clause libraries lag the current statute. Read the citation, then read the current source. The gap between the two is where avoidable delay lives.
Common objections, answered plainly
Isn't this just a way around competition?
It is a finding that competition already happened. The company won a merit-based selection against a field to reach Phase I or Phase II, and Congress decided that competition should count for the follow-on rather than force a firm to compete twice for technology it created. Whether those earlier competitions are rigorous enough to carry the weight is a fair debate, but it is a debate about the earlier phases, not about Phase III.
Does the Phase III scope have to resemble the Phase II scope?
It has to derive from, extend, or complete it, which is a lower bar than resemblance. Phase III work may be products, production, services, further research and development, or any combination. What it cannot be is a requirement the government defined independently that happens to sit in the same technical area.
Can a prime contractor issue a Phase III to a subcontractor?
Yes. The statute reaches federal prime contractors, and the Policy Directive states that a subcontract to a federally funded prime contract may be a Phase III award. When it is, the subcontract carries SBIR/STTR status and data rights along with it, which is worth confirming in the subcontract terms rather than assuming.
Does the company have to still be small?
No. The size limits that apply at Phase I and Phase II do not apply to Phase III, and NASA's guidance says eligibility persists even if the company grows past the size standard. Eligibility is tied to having developed the technology under the earlier award, not to current size.
Bottom line
Phase III is the strongest non-competitive position a technology company can hold in the federal market, and it is narrower than its reputation. The authority is unlimited in dollars and duration but tightly bounded in subject matter: it covers the specific technology the company developed, and it runs only to that company or its successor in title. The paperwork is light. The preference carries named deadlines and a reporting line to Congress. The data rights are what make an agency prefer the incumbent rather than merely permit it.
The 2026 reauthorization reads like Congress agreeing that the authority works and the execution does not, answering with training, model contracts, standardized clauses, and data flags rather than new substantive rights. For anyone deciding whether a requirement belongs in this lane, the analysis has not changed. Name the prior award, name what came out of it, show how the new work depends on that. The rest follows from those three sentences.
Frequently asked questions
No. The SBA Policy Directive states there is no limit on the number, duration, type, or dollar value of Phase III awards, and no limit on the time that may elapse between the earlier phase and the Phase III or between successive Phase III awards.
Yes. Any federal agency may award a Phase III regardless of which agency funded the earlier phases, and government-owned contractor-operated laboratories and federally funded research and development centers are covered too. NASA states plainly that a NASA Phase III can rest on a Phase I or II performed for another agency, and the reverse.
Where the agency deems a justification and approval required at all, it is sufficient to state that the project is an SBIR or STTR Phase III award derived from, extending, or completing efforts made under prior funding agreements and authorized pursuant to 15 U.S.C. 638(r)(4). The Department of Energy's guidance adds that further justification is not needed.
Twenty years from the funding agreement award, or longer at the agency's discretion, under the SBA Policy Directive. DFARS 252.227-7018 was amended effective January 17, 2025 to a single twenty-year period, after which the government holds perpetual government purpose rights. FAR 52.227-20 still recites an older four-year period, but SBA sets the protection period.
GAO has declined to review an agency's decision not to enter a non-competitive Phase III agreement since Complere Inc. in 2012. SBA can appeal such a decision through the Policy Directive process. And in July 2026 the Court of Federal Claims allowed a Phase III preference protest past a motion to dismiss in Strategi Consulting, LLC v. United States, which is a jurisdictional ruling rather than a decision on the merits.