The customer, in one paragraph
The Federal Aviation Administration operates the busiest airspace in the world. About 45,000 employees, roughly 20 billion dollars a year, more than 45,000 flights a day moving through radars, automation platforms, communication links and data feeds that are not permitted to go down. For a firm that builds AI, ML, data and cloud systems, FAA is one of the most interesting civil customers in government, and one of the easiest to approach the wrong way. The most common vendor mistake is assuming the Federal Acquisition Regulation applies. It does not.
FAA is not a FAR agency
In 1995 Congress told FAA to build its own procurement system. Section 348 of the Department of Transportation and Related Agencies Appropriations Act, 1996 (Pub. L. 104-50), now codified at 49 U.S.C. § 40110(d), exempted the agency from most federal acquisition law. FAA stood up its Acquisition Management System, or AMS, on April 1, 1996. The AMS is published on the FAA Acquisition System Toolset at fast.faa.gov, and it is the actual rulebook. FAR parts, DFARS supplements and the standard clause library do not govern an FAA award unless FAA adopted that language into the AMS.
Three consequences matter. The first is vocabulary. FAA issues a Screening Information Request, or SIR, where other agencies issue an RFP, and runs Market Surveys where others run Sources Sought. It screens offerors down across phases rather than running one evaluation at the end.
The second is discretion. AMS gives contracting officers wide latitude to structure competition: staged down-selects, oral presentations, early elimination, and criteria written for the specific buy rather than pulled from a standard library. A firm that submits a sixty-page technical volume when the SIR asked for a ten-page capability screening does not get scored low. It gets removed.
The third is protests. FAA bid protests do not go to the Government Accountability Office, which has no jurisdiction over FAA procurements under the same statute. Protests and disputes go to the FAA Office of Dispute Resolution for Acquisition, or ODRA, under 14 CFR Part 17. The window is short: 14 CFR § 17.15 requires a protest within seven business days of when the protester knew or should have known the basis. ODRA leans on alternative dispute resolution and settles most matters without formal adjudication.
Where the money actually sits
FAA's budget arrives in four accounts. Only two buy the kind of work an engineering firm sells.
Operations. The largest account, roughly 12 to 13 billion dollars, paying controllers, safety inspectors, and the daily running of the National Airspace System. Sustainment services ride here.
Facilities and Equipment. About 3 billion dollars a year, and the capital account that matters most to technology vendors. Every NAS automation platform, surveillance system, communications upgrade and infrastructure recapitalization is funded from F&E. If a program has hardware, software, and a deployment schedule, it lives here.
Research, Engineering and Development. Small by comparison, historically under 300 million dollars a year, funding the Technical Center, safety research, and the university Centers of Excellence.
Grants-in-Aid for Airports. Roughly 3.35 billion dollars a year in contract authority to airport sponsors. Airports spend it, not FAA, and selling into it is a different motion.
On top of the annual accounts, the reconciliation law enacted in July 2025 provided 12.5 billion dollars specifically for air traffic control system modernization. That sits above the five-year authorization in the FAA Reauthorization Act of 2024 (Pub. L. 118-63, signed May 16, 2024), which runs the agency through fiscal 2028. Together they are why FAA technology buying looks materially different in 2026 than it did in 2023.
Entry Difficulty by Work Type at FAA
Editorial weighting of accessibility for a new entrant. Illustrative, not a measured statistic.
The offices that hold the budget
FAA organizes into lines of business. A vendor who cannot name the right one is talking to the wrong office.
- Air Traffic Organization (ATO). The operating arm, around 35,000 people, running the NAS through en route centers, terminal facilities and towers. Led by a Chief Operating Officer, a statutory position under 49 U.S.C. § 106(r). Holds most F&E program money.
- Aviation Safety (AVS). Certification and oversight: Aircraft Certification Service, Flight Standards Service, the Office of Aerospace Medicine. Buys data systems, analytics and inspection tooling.
- Finance and Management (AFN). Houses the acquisition organization and the Office of Information and Technology, the agency CIO shop. Enterprise IT, cloud, cybersecurity, business systems.
- Commercial Space Transportation (AST). Launch and reentry licensing under 14 CFR Part 450, plus the airspace integration problem of rising launch cadence.
- William J. Hughes Technical Center. Atlantic City, New Jersey. The laboratory: simulation, test beds, NAS integration, cyber testing before anything touches live operations.
- Mike Monroney Aeronautical Center. Oklahoma City. The FAA Academy, Logistics Center, Civil Aerospace Medical Institute, Aircraft Registry, and the Enterprise Services Center.
The vehicles
FAA buys services through a few large multiple-award instruments. Knowing which carries which work is most of the targeting problem.
| Vehicle | What rides on it | How a smaller firm gets in |
|---|---|---|
| eFAST | FAA's multiple-award services IDIQ, seven functional areas spanning engineering, information systems development, and R&D. | Directly. The on-ramp never closes: submit a prequalification, then compete for task orders. |
| SE2025 | Systems engineering and technical support to ATO and NAS modernization programs. | Subcontract seat filling a named technical discipline. |
| ITSSS-2 | Enterprise IT for the CIO organization: infrastructure, applications, cybersecurity. | Subcontract, or supply a specialty the holder lacks. |
| NISC IV | NAS Integration Support: program management, engineering analysis, implementation. | Subcontract on a program office task. |
| GSA and governmentwide | Commodity IT and some services through GSA MAS, Alliant 2, 8(a) STARS III, NASA SEWP. | Hold a schedule, or team with a holder. |
| DOT SBIR | One DOT solicitation covering FAA and the other modal administrations, run through the Volpe Center. Contracts, not grants. | Respond to a published FAA subtopic. |
How work actually flows
A NAS program does not begin with a SIR. It begins inside the AMS lifecycle: a mission analysis identifies a service shortfall, the Joint Resources Council approves an investment decision, and requirements get shaped by the program office, the Technical Center, and MITRE's Center for Advanced Aviation System Development, the federally funded research center supporting FAA on NAS architecture. Only then does a SIR appear, typically eighteen months or more after the requirement started forming.
That is why the market survey matters more at FAA than the SIR does. A market survey response puts a firm's approach in front of a program office while the requirement is still soft enough to absorb it. Firms arriving first at SIR release are reading a document shaped around somebody else's capability.
Task orders behave differently. On eFAST, a competed task order can move from posting to award in weeks, and the competition is limited to vendors already prequalified in the relevant functional area. That is the fastest legitimate path into FAA for a firm with real engineering depth and no FAA contract history.
The data FAA holds
Three bodies of data sit inside the agency, each with its own access regime.
NAS operations data. Flight plans, track data, flow-management restrictions, terminal events, time-based metering, weather products, notices to air missions. Most of it moves inside System Wide Information Management, or SWIM, FAA's publish-subscribe backbone for NAS information. A large share of SWIM content reaches the public at no cost through the SWIM Cloud Distribution Service, which streams Traffic Flow Management System data, the SWIM Terminal Data Distribution System, Time-Based Flow Management, the Federal NOTAM System, and Integrated Terminal Weather System products. Registration is free, the feeds are live, the schemas are published. There is no better place for a firm to prove it can handle FAA data than to build something real on that service before ever bidding.
Safety data. Aviation Safety runs substantially on voluntarily reported information, and that information is legally protected. 49 U.S.C. § 40123 shields voluntarily submitted safety and security information from disclosure, and 14 CFR Part 193 sets the process by which FAA designates a class of information as protected. Aviation Safety Action Program reports and Flight Operational Quality Assurance data from carriers feed the Aviation Safety Information Analysis and Sharing program, which fuses de-identified operator data with FAA surveillance and weather sources. NASA runs the Aviation Safety Reporting System for FAA as a confidential third-party channel, which is why pilots trust it. A vendor does not receive raw carrier reports; a vendor works inside a governed environment with de-identification already built in.
Certification data. Type certificates, supplemental type certificates, Technical Standard Order authorizations, airworthiness directives, service difficulty reports, and the record of how each aircraft or component was approved. Some is public. Much is proprietary to the applicant and held under trade-secret protection. The workflow problem is unglamorous and real: certification is document-heavy, review queues are long, and Aircraft Certification Service has been under sustained congressional pressure to shorten them. Structured extraction with provenance an auditor can follow is a live agency need, not a speculative one.
The harder AI question: learned components in the aircraft
FAA's assurance expectations for airborne systems run through RTCA standards recognized by advisory circular: DO-178C for software, recognized through AC 20-115D, and DO-254 for airborne electronic hardware, recognized through AC 20-152A. Both were written for deterministic systems with traceable requirement decomposition. A learned model does not decompose that way, which is why machine learning inside a safety-critical aviation function remains an open certification problem rather than a settled process.
Two efforts are moving it. FAA published its Roadmap for Artificial Intelligence Safety Assurance, Version 1, in July 2024. In parallel, the joint SAE G-34 and EUROCAE WG-114 committee is drafting ARP6983 and ED-324, a process standard for aeronautical products that implement AI. Engineers who understand both the model and the assurance argument are scarce. That scarcity is the opening.
Security and access: what actually gates entry
FAA is a civil agency and most of its work is unclassified. That shifts the entry calculus in a smaller firm's favor: the gates are real, but they are not clearances.
Sensitive Security Information. Governed by 49 CFR Part 15 on the DOT side, mirrored in TSA's 49 CFR Part 1520. SSI is a legal handling control, not a classification: access requires covered-person status and a need to know, and mishandling carries civil penalties. Separately, FAA Order 1600.75 governs the agency's own sensitive-but-unclassified information, now aligned with the Controlled Unclassified Information framework at 32 CFR Part 2002.
Badging and suitability. Contractor personnel needing facility or system access receive an HSPD-12 credential after a background investigation scaled to position risk. Moderate-risk public trust covers most IT and analytic roles; high-risk applies to privileged access on operational systems. This is suitability adjudication rather than a security clearance, and it runs in weeks to a few months rather than a year.
System authorization. FAA is a FISMA agency. NIST SP 800-53 controls apply, cloud services must be FedRAMP authorized, and anything touching the operational NAS is assessed against FAA's own security requirements and exercised at the Technical Center before it goes near live traffic. Schedule for it from the first proposal. It is the step that surprises commercial software firms most.
The research lanes
Three paths exist for work that is not a production services contract, all open to a firm without FAA history.
DOT runs one SBIR solicitation covering FAA and the other modal administrations, through the Volpe National Transportation Systems Center. Awards are firm-fixed-price contracts rather than grants. SBA's inflation-adjusted guideline amounts put Phase I at $314,363 and Phase II at $2,095,748, and DOT typically awards below those ceilings. The value is not only the money: an FAA subtopic is a program office describing a problem it already owns.
FAA also funds university-led Centers of Excellence, the natural home for an STTR-shaped partnership. ASSURE covers unmanned aircraft systems, led by Mississippi State University. ASCENT covers alternative jet fuels and environment, led by Washington State University and MIT. PEGASAS covers general aviation safety, led by Purdue. A firm arriving with a research partner already inside one of those consortia starts several steps ahead.
Third, FAA issues Broad Agency Announcements and awards aviation research grants under 49 U.S.C. § 44511, usually run out of the Technical Center.
Where a smaller engineering firm fits
Four categories of work are reachable without FAA past performance.
Data engineering against published feeds. The SWIM cloud service is open to anyone. Building ingest, normalization, storage and analytics on live NAS data is something a team can do this quarter, at its own expense, and put in front of a program office as running software rather than a slide.
Document and records work. Aviation Safety and Aircraft Certification move on documents. Extraction with provenance an auditor can defend beats fluent generation every time here.
Modernization of aging systems. FAA runs software older than many of the people maintaining it, and the 12.5 billion dollar appropriation is aimed at exactly that. The work decomposes into components a focused team can own as a subcontractor without carrying the whole platform.
Cloud and platform engineering. The CIO organization is moving workloads and needs engineers who read authorization boundaries and federal security documentation as fluently as they read infrastructure.
Two areas move on a different clock. Prime integration of a NAS automation platform runs through decade-long incumbent programs, which makes the subcontract seat the sensible door and the one that converts into follow-on scope. Certified avionics with a learned component is a research position today rather than a services buy, which is why the SBIR and Center of Excellence lanes are the way in.
The concrete first step
Reading about FAA acquisition is not the same as being positioned for it. Every step below can start this week, without permission from anyone.
Getting Positioned at FAA
Bottom line
If a firm does one thing this month, make it the eFAST prequalification. It is the instrument FAA built to buy services from smaller companies, the on-ramp does not close, and it places a firm inside the competitive pool for task orders that never reach the open market. Pair it with something real built on published NAS data, because FAA program offices respond to running code. The Acquisition Management System is a different rulebook, not a harder one. Firms that read it get in. Firms that assume the FAR spend a year finding out why they were screened out on page one.
Frequently asked questions
No. 49 U.S.C. § 40110(d) exempts FAA from most federal acquisition law, and the agency buys under its own Acquisition Management System, published at fast.faa.gov. Some AMS provisions resemble FAR language, but the FAR governs an FAA award only where FAA adopted that text.
The FAA Office of Dispute Resolution for Acquisition, under 14 CFR Part 17. GAO has no jurisdiction over FAA procurements. Under 14 CFR § 17.15 the window is seven business days from when the protester knew or should have known the grounds, far shorter than the GAO timeline most vendors expect.
eFAST is FAA's multiple-award services IDIQ, structured around seven functional areas and aimed at smaller businesses. The on-ramp is continuously open: submit a prequalification application, then compete for task orders in the areas approved.
A great deal of it. The SWIM Cloud Distribution Service streams live National Airspace System feeds free after registration, with published schemas. Voluntarily reported safety data is protected under 49 U.S.C. § 40123 and 14 CFR Part 193.
Usually not. Most FAA work is unclassified. Access turns on suitability adjudication and an HSPD-12 credential scaled to position risk, plus SSI handling rules under 49 CFR Part 15.