The contract says the state. The rules were written somewhere else.
A health department buys claims analytics. A transportation department buys a crash-data pipeline. An emergency management office buys a records system. In each case a state or local agency signs, a state warrant pays the invoice, and some or all of the dollars started as a federal grant. What the vendor sees is an ordinary purchase order. What rides on it is a body of federal rule that already decided how the buyer had to run the competition, which clauses appear in the contract, who ends up owning the code, how long the records live, and the date on which the money stops being money.
Most of it sits in one place: 2 CFR part 200, the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, known as the Uniform Guidance. OMB rewrote large sections of it in 2024, and program-specific regimes sit on top. What follows is the mechanics that touch a technology vendor, with the citation attached to each one.
Contractor or subrecipient: the determination that sets everything else
Before any clause matters, one question does. When a state or local government passes federal money onward, it must decide whether the receiving organization is a subrecipient carrying out part of the program, or a contractor selling goods and services. 2 CFR 200.331 lists the characteristics on both sides.
A subrecipient determines who is eligible to receive federal assistance, has responsibility for programmatic decision-making, has its performance measured against whether the objectives of a federal program were met, is responsible for adherence to federal program requirements, and implements a program for a public purpose named in the authorizing statute. A contractor provides goods and services within its normal business operations, to many different purchasers, normally operates in a competitive environment, provides goods or services ancillary to the federal program, and is not subject to the program's compliance requirements as a result of the agreement. The regulation adds a qualifier worth reading twice: similar requirements may still apply to a contractor for other reasons.
Most analytics, engineering and software work is a contractor relationship. Some of it is not. A vendor that operates an eligibility screening rule, decides which applicants clear a threshold, or runs an outreach program on the agency's behalf has drifted to the subrecipient side.
| What it decides | Contractor | Subrecipient |
|---|---|---|
| The relationship | Goods or services in your normal line of business, sold to many purchasers, competitively, ancillary to the program. | You decide eligibility, make programmatic decisions, are measured against program objectives, carry out a public purpose in the statute. |
| Program compliance | Not subject to the program's compliance requirements as a result of the agreement, though similar requirements may apply for other reasons. | Responsible for adherence to the applicable federal program requirements. |
| Indirect cost | Your price is a price. Above the simplified acquisition threshold the buyer runs a cost or price analysis on it (200.324). | A federally negotiated rate, a rate negotiated with the pass-through, or the de minimis rate of up to 15 percent of modified total direct costs (200.414). |
| Public reporting | A contract, not a subaward. No first-tier subaward report. | Subawards of $30,000 or more are reported by the end of the month after issuance (Appendix A to 2 CFR part 170). |
| Audit exposure | The buyer must show that procurement, receipt and payment complied (200.501(h)). It asks you for records; it does not audit you. | Awards expended as a subrecipient are subject to audit. Subpart F does not apply to for-profit entities, so the pass-through sets its own requirements (200.501(i)). |
| What the paper says | Ordinary contract terms plus the flow-downs in Appendix II. | The 200.332 data elements: award identification number, period of performance, budget period, Assistance Listings title and number, indirect rate. |
The determination is the buyer's to make, on substance rather than on what the document is titled. Find out which one it is before signing, in writing. Being called a subrecipient puts an accounting system, an indirect rate, a monitoring regime and a public reporting obligation into scope that a fixed-price service contract would never have touched, and for a for-profit subrecipient the pass-through invents that regime itself: an agency-designed audit clause negotiated late and priced never.
Where pass-through money actually changes a technology vendor's work
Editorial weighting: how often each item changes what a vendor actually does, rather than being signed once and filed. A ranking, not a measured statistic.
What rides down into the contract
2 CFR 200.327 is one sentence long: contracts must contain the applicable provisions described in Appendix II to part 200. Appendix II is where the flow-downs live, and it is worth knowing which reach a software scope and which are construction furniture that arrives in the attachment anyway.
Remedies for breach. Contracts above the simplified acquisition threshold must address administrative, contractual or legal remedies where the contractor breaches contract terms, with sanctions and penalties as appropriate, citing 41 U.S.C. 1908.
Termination. All contracts above $10,000 must address termination for cause and for convenience, including the manner in which it is effected and the basis for settlement. A convenience termination with no settlement mechanism is a cash-flow problem waiting to happen, so read the settlement language, not just the notice period.
Debarment and suspension. Awards must not be made to parties listed on the governmentwide exclusions in the System for Award Management, under Executive Orders 12549 and 12689 and the rules at 2 CFR part 180. This is the one flow-down that reaches every vendor at every dollar value.
Byrd Anti-Lobbying Amendment. Contractors bidding on an award over $100,000 certify that no federal appropriated funds were paid for lobbying, and disclose non-federal lobbying, under 31 U.S.C. 1352.
Rights to inventions. Where the contract is a funding agreement for experimental, developmental or research work, the Bayh-Dole regulations at 37 CFR part 401 apply. Not every grant-funded build is research, but pilots and demonstrations sometimes are, and the invention-rights posture changes when they are.
Appendix II also carries the domestic-preference, recovered-materials and telecommunications requirements at 2 CFR 200.322, 200.323 and 200.216 into contracts, covered below. The construction-shaped clauses are keyed to construction labor: equal employment opportunity under 41 CFR 60-1.4(b), Davis-Bacon prevailing wages under 40 U.S.C. 3141 through 3148 for prime construction contracts over $2,000, and the Contract Work Hours and Safety Standards Act for contracts over $100,000 employing mechanics or laborers. They get pasted into services attachments anyway. Signing a clause that does not apply is usually harmless and occasionally not, so a short note identifying which flow-downs the vendor understands to be inapplicable is cheaper than an argument during closeout.
The thresholds moved, and most grant manuals still print the old numbers
2 CFR 200.320 sets the shape of the buyer's competition by dollar value. Informal methods cover everything at or below the simplified acquisition threshold: micro-purchases at the bottom, simplified acquisitions above them. Formal methods, sealed bids or proposals, are required above the threshold. The Uniform Guidance does not print the numbers: 200.1 defines both by reference to the FAR at 48 CFR part 2, subpart 2.1.
That is where the change happened. Statutory acquisition-related thresholds are adjusted for inflation every five years, and a FAR final rule implementing the adjustment was published on August 27, 2025. FAR 2.101 as of FAC 2026-01, effective March 13, 2026, sets the base micro-purchase threshold at $15,000 and the base simplified acquisition threshold at $350,000. A great deal of published grant guidance and state procurement training still shows the prior figures.
| Tier | Current amount | What it means for the buyer |
|---|---|---|
| Micro-purchase | $15,000 base (48 CFR 2.101) | May be awarded without competitive quotations if the price is considered reasonable. |
| Self-certified micro-purchase | Up to $50,000, annually (2 CFR 200.320) | A recipient may self-certify a higher threshold, with documentation. Above $50,000 needs agency approval. |
| Simplified acquisition | $350,000 base (48 CFR 2.101) | Informal methods: price or rate quotations from an adequate number of qualified sources. |
| Above simplified acquisition | Over $350,000 | Formal methods. Sealed bids, or proposals with negotiation. Cost or price analysis required. |
| Labor-standards exceptions | $2,000 / $2,500 | Micro-purchase drops to $2,000 for Davis-Bacon construction and $2,500 for services under the Service Contract Labor Standards. |
One qualifier decides whether any of that helps. Under 2 CFR 200.317, a state conducting procurement under a federal award follows the same policies and procedures it uses for its own funds, and must comply with 200.321, 200.322, 200.323 and 200.327 regardless. Every other recipient and subrecipient, including counties, cities, districts and nonprofits receiving a subaward from a state, follows the full standards at 200.318 through 200.327. A state's own ceiling may sit well below $350,000, and the tighter of the two governs. The useful pre-bid question is therefore not what the federal threshold is, but which one the buyer applies.
The price gets analyzed, not just compared
2 CFR 200.324 requires the recipient or subrecipient to perform a cost or price analysis for every procurement transaction, including contract modifications, in excess of the simplified acquisition threshold, and to make independent estimates before receiving bids or proposals. Costs based on estimated costs are allowable only to the extent they would be allowable under the cost principles in subpart E. The cost-plus-a-percentage-of-cost and percentage-of-construction-cost methods are prohibited outright.
Three consequences follow for a vendor's pricing page. A lump sum with no visible basis invites a request for backup, and that request arrives after selection, when the negotiating position is gone; a labor-category breakdown with hours and rates answers the analysis before it is asked. Modifications are covered by the same rule, so a change order that pushes a $300,000 contract over the threshold triggers an analysis the original award avoided. And time-and-materials is permitted under 2 CFR 200.318 only when no other contract type is suitable and only with a ceiling the contractor exceeds at its own risk, so a T&M quote without a not-to-exceed is not a compliant structure.
The buyer must also keep records detailing the history of each procurement transaction: the rationale for the method, the contract type, contractor selection or rejection, and the basis for the price. Your proposal, quote and clarification emails become exhibits in it.
Competition, preferences, and one paragraph that is no longer where it was
2 CFR 200.319 requires all procurement transactions to provide full and open competition, and lists practices that restrict it: unreasonable requirements on firms in order to qualify, unnecessary experience and excessive bonding, noncompetitive pricing between firms or affiliates, a brand name specified without allowing an equal, organizational conflicts of interest, and any arbitrary action in the process. Prequalified lists must include enough qualified sources to ensure maximum open competition, and must not preclude potential bidders from qualifying during the solicitation period.
That last clause is a working tool. A firm shut out of a state's qualified vendor list because the pool closed two years ago has a citable argument when the procurement is federally funded, and it does not depend on protesting anything.
One change is worth flagging plainly, because it is easy to get wrong from memory. Through the 2023 edition of the CFR, 2 CFR 200.319(c) read that the non-Federal entity "must conduct procurements in a manner that prohibits the use of statutorily or administratively imposed state, local, or tribal geographical preferences in the evaluation of bids or proposals, except in those cases where applicable Federal statutes expressly mandate or encourage geographic preference." That paragraph is not in the current text of 200.319. Out-of-state vendors have leaned on it for years. Program statutes, agency award terms and the general full-and-open-competition requirement still bear on preference schemes, so the analysis has not disappeared, but anyone citing the old sentence should read the current section first.
Pointing the other way, 2 CFR 200.321 requires affirmative steps to include small businesses, minority businesses, women's business enterprises, veteran-owned businesses and labor surplus area firms whenever possible: placing them on solicitation lists, soliciting them when eligible, dividing total requirements into smaller tasks or quantities to permit maximum participation, and requiring the prime contractor to take the same steps in its subcontracts. States must comply with 200.321 even though they otherwise follow their own procedures. The clause about dividing requirements creates entry points for a firm that cannot bid an enterprise integration but can deliver one module of it well.
Who owns what you build
2 CFR 200.315 governs intangible property. A recipient may copyright work developed under a federal award, and the federal agency reserves a royalty-free, nonexclusive and irrevocable right to reproduce, publish or otherwise use it for federal purposes, and to authorize others to do so. The government has parallel rights in data produced under an award. Patent rights follow 37 CFR part 401.
Program rules can go further. In Medicaid systems, 42 CFR 433.112 makes 90 percent federal financial participation available for the design, development, installation or enhancement of mechanized claims processing and information retrieval systems, and one condition is direct: the state owns any software designed, developed, installed or improved with 90 percent FFP, and the Department receives a royalty-free, non-exclusive and irrevocable license to use it for federal purposes. Other conditions in the same section require a modular, flexible approach using open interfaces and exposed application programming interfaces, alignment with MITA maturity and health IT standards at 45 CFR part 170, and Section 508 accessibility.
None of that is a reason to walk away. It is a reason to be precise on paper before award: separate pre-existing components from work made under the award, name them in an exhibit, and price delivered work as delivered work. A firm that intends to reuse a matching engine across customers should say so in the response rather than discover the ownership clause during closeout. The open-API condition, read the other way, works in a challenger's favor: it is federal authority against being locked out by an incumbent's closed interface.
The calendar belongs to the award, not to the agency
A grant-funded contract has two clocks. The contract end date is the visible one. The award's period of performance and spend-by date is the one that governs, and it does not move because a project slipped.
The clearest live example is the Coronavirus State and Local Fiscal Recovery Funds. Under 31 CFR 35.5, recipients had to obligate funds by December 31, 2024, and funds obligated by that date but not expended by December 31, 2026 must be returned, with an earlier September 30, 2026 date for the surface transportation and Title I category. A vendor quoting that work in 2026 is quoting against a hard expiry, which explains schedule pressure that would otherwise look irrational.
Medicaid and related human-services systems run on a different clock: federal prior approval. Under 45 CFR 95.611, a state seeking enhanced FFP must obtain written approval of all planning and implementation Advance Planning Documents regardless of cost, and of acquisition documents and contracts at a $500,000 threshold, with amendments approved when they exceed $500,000 or extend the contract by more than 60 days. For regular FFP the thresholds are higher: $5,000,000 in total acquisition cost for APDs, $6,000,000 competitive or $1,000,000 noncompetitive for software development, and $20,000,000 competitive or $1,000,000 noncompetitive for hardware and commercial off-the-shelf software. The Department has 60 days to respond. A solicitation can sit still for months while an amendment clears, and none of that shows on the state's procurement calendar.
Larger projects bring a second seat to the table. 45 CFR 95.626 provides for Independent Verification and Validation on projects at risk of missing statutory deadlines, or at risk of failure, major delay or cost overrun. The work must be performed by an entity independent from the state, the contract requires prior written departmental approval and must name key personnel, and the provider reports findings to the federal agency at the same time it reports to the state. It is a distinct scope that a firm building the system cannot also hold.
Cash flow deserves its own line. 2 CFR 200.305 requires payment methods that minimize the time between the transfer of funds and disbursement, and reimbursement is preferred when the conditions for advance payment are not met. A grant-funded invoice often waits on the recipient's draw cycle, so net-30 on paper can be net-60 in fact. Price the working capital rather than being surprised by it.
Hardware pulls in rules that software does not
2 CFR 200.322 states that recipients and subrecipients should, to the greatest extent practicable and consistent with law, provide a preference for goods, products or materials produced in the United States, and include the requirement in all subawards, contracts and purchase orders. It reaches iron and steel, manufactured products, and construction materials, a category that includes glass and optical fiber.
The stronger requirement is the Buy America Preference at 2 CFR part 184, implementing the Build America, Buy America Act. It attaches to infrastructure projects, defined at 2 CFR 184.3 as any activity related to the construction, alteration, maintenance or repair of infrastructure in the United States, and requires the iron, steel, manufactured products and construction materials incorporated into the project to be produced in the United States. A pure software or analytics scope generally sits outside it. Sensors, cabinets, fiber, servers and field hardware inside an infrastructure award do not.
2 CFR 200.216 implements section 889 of Public Law 115-232. Recipients and subrecipients may not obligate or expend grant funds to procure or obtain, or to extend or renew a contract for, covered telecommunications and video surveillance equipment or services as a substantial or essential component of any system, and the statute names specific manufacturers. Recipients certify compliance. For a vendor this is a supply-chain question rather than a paperwork question: the bill of materials for anything with a radio, a camera or a network interface gets checked against the covered list before it is quoted. On a mixed scope, quote software and services separately from hardware.
Records, and the file you will be asked for
2 CFR 200.334 requires federal award records to be retained three years from submission of the final financial report, or from each quarterly or annual report for awards renewed on that cycle, extended until resolution if litigation, a claim or an audit starts first. Equipment and property records run three years after disposition.
The audit exposure is indirect and worth understanding exactly. 2 CFR 200.501 requires a single or program-specific audit of any non-federal entity expending $1,000,000 or more in federal awards in its fiscal year. Under 200.501(h), the auditee's compliance responsibility for contractors is in most cases to ensure that procurement, receipt and payment comply with federal statutes, regulations and the award terms, and where the transaction requires the contractor to meet program requirements, the auditee ensures compliance through clearly stated contract terms and record review. A vendor is not the audit subject, and is very much the source of documents. Invoice backing, the acceptance record for each deliverable, timesheet detail behind a T&M line and the change-order trail all get pulled, often a year or two after the work ended.
- Ask in writing whether the agreement makes you a contractor or a subrecipient, before you price it.
- Ask for the Assistance Listings title and number funding the scope, then read the program's rules and the award terms.
- Ask which procurement threshold the buyer applies, its own or the federal one.
- Ask for the award's period of performance and spend-by date, not just the contract end date.
- Read the ownership and license clause before the technical response, and name pre-existing components in an exhibit.
- Put a ceiling on any time-and-materials line, and a labor-category basis under any fixed price.
- Check the bill of materials for anything with a radio, a camera or a network interface before quoting hardware.
- Plan the records now: acceptance evidence, invoice backing and change-order history, held three years past the final report.
Bottom line
Federal pass-through money does not make a state contract harder to win. It makes it more legible. The competition rules, the price analysis, the flow-downs, the ownership terms and the spend-by date are all published, and a vendor who reads them arrives knowing why the agency is asking for what it is asking for. The two questions that carry the most weight are also the shortest: which award funds this scope, and does that award treat me as a contractor or a subrecipient.
Frequently asked questions
Ask for the Assistance Listings title and number. Pass-through entities must give that identifier to subrecipients under 2 CFR 200.332, and most will supply it for a contract too. The solicitation usually gives it away anyway: an Appendix II clause set, a certification about exclusions and lobbying, or a period-of-performance date that does not match the state fiscal year.
2 CFR 200.331 draws it on substance. A subrecipient carries out part of the federal program, makes programmatic decisions, and is responsible for program compliance. A contractor sells goods or services in its normal line of business, to many purchasers, competitively, and is not subject to the program's compliance requirements as a result of the agreement. The label on the document does not control, and the consequences differ sharply on indirect cost, reporting, monitoring and audit.
2 CFR 200.1 defines both by reference to the FAR. As of FAC 2026-01, effective March 13, 2026, 48 CFR 2.101 sets the base micro-purchase threshold at $15,000 and the base simplified acquisition threshold at $350,000, after the five-year inflation adjustment published on August 27, 2025. Separately, 2 CFR 200.320 lets a recipient self-certify a micro-purchase threshold up to $50,000 annually. A state may apply a lower ceiling of its own, and the lower one governs.
It depends on the program and the contract. Under 2 CFR 200.315 the recipient may copyright the work and the federal agency reserves a royalty-free, nonexclusive, irrevocable right to use it for federal purposes. Some programs go further: 42 CFR 433.112 provides that the state owns any software designed, developed, installed or improved with 90 percent Medicaid federal financial participation. Name pre-existing components explicitly before award rather than negotiating them afterward.
Not as a contractor. 2 CFR 200.501 applies the single audit requirement to entities expending $1,000,000 or more in federal awards, and under 200.501(h) the buyer's responsibility toward contractors is to show that procurement, receipt and payment complied. You supply records rather than undergo an audit. A for-profit classified as a subrecipient is different: subpart F does not apply to for-profit entities, so the pass-through sets its own monitoring requirements, a term to negotiate up front.