{"resourceId":"north-carolina-ncdit-rfp-800000-statewide-genai-frontier-model-platforms-20261028","versions":[{"version":"external-d75d3494eb40e312c32ee24d9c98167be99e4a2cfd8f12258ed3c45df5759a2a","resource":{"id":"north-carolina-ncdit-rfp-800000-statewide-genai-frontier-model-platforms-20261028","title":"North Carolina issues statewide multi-vendor RFP for enterprise GenAI platforms and frontier-model APIs, open only to model owners, with state-controlled retention for public records and configurable agent autonomy","organization":"North Carolina Department of Information Technology (NCDIT), Statewide IT Procurement Office","sector":"State enterprise IT procurement; generative AI platforms, model APIs and adoption services","geography":"North Carolina, U.S.","publishedAt":"2026-10-28 (NCDIT press release); RFP ITS-800000 issue date 2026-10-26; GovTech coverage 2026-10-29","publicationDate":"2026-10-28","eventDate":"2026-10-26","sourceName":"North Carolina Department of Information Technology","sourceLabel":"NCDIT press release 'NCDIT Issues RFP for AI Platforms & Services' (Oct 28, 2026), with RFP ITS-800000 'Statewide GenAI Contract' and GovTech report (Oct 29, 2026)","sourceUrl":"https://it.nc.gov/news/press-releases/2026/10/28/ncdit-issues-rfp-ai-platforms-services","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","developers-agents","data-security","accessibility-workforce"],"finding":"NCDIT issued RFP ITS-800000 on Oct 26 (announced Oct 28) to select multiple vendors for enterprise GenAI platforms, secure API access to their frontier models, and implementation, integration, AI literacy and role-based training for state agencies. Only vendors that own the frontier models may bid; resellers and companies building on others' models are deemed non-responsive, though resellers may fulfill orders later. Requirements include U.S.-only storage and processing, GovRAMP or FedRAMP status or a dated roadmap to GovRAMP authorization within two years, WCAG 2.1 AA accessibility, and state-configurable agent autonomy (read-only or draft-only modes, approval checkpoints, cancellation). Inputs and outputs are state data and may be public records; state retention schedules override vendor deletion defaults. Questions are due Nov. 9 and proposals Nov. 30; the term is three years with two optional one-year renewals. NC's AI governance executive told GovTech a tool once nearly rolled out before the state learned it could not meet public records requirements.","sledRelevance":"Why now: issued this week and not in our archive. It is one of the most detailed state procurement specifications yet for enterprise GenAI and agents, and it writes lessons states have learned (public records, retention, agent controls, training) directly into contract requirements. Other states building statewide AI contracts can compare their terms against it, and bidders have under five weeks to respond.","evidence":"Official press release opened in full; the RFP PDF opened and its scope, business and technical requirements, agentic functionality, public records and term sections read; GovTech report opened for the frontier-model definition and the state AI executive's comments. This is a solicitation: it shows what the state requires, not how any platform performs.","architectureImplications":"Interpretation: the specification assumes both a seat-based assistant and API access for state applications, chatbots and agents, with SSO integration, audit logs exportable to state security tools, Model Context Protocol-style tool connections, and regression testing when models, prompts or knowledge sources change. Multi-vendor award means agencies may run more than one platform, so identity, logging and records integration must work across them.","governanceImplications":"Tools bought under the contract must operate within the N.C. Responsible Use of AI Framework and Executive Order 24. The RFP turns governance into bid requirements: configurable agent autonomy and approval steps, least-privilege delegated identity for agents, retention and legal hold under state control, and responsible-AI and accessibility responses.","securityPrivacyImplications":"U.S. data residency is a certify-or-fail requirement; vendors must describe authorization status and hosting environment, prompt-injection and data-leakage testing, and handling of restricted legal data, including whether it is used for model training.","caveats":"A solicitation, not an award or outcome. Pricing schedules do not guarantee purchase volume. The reseller exclusion and frontier-model definition may change through addenda; an addendum notes modifications in Ariba that were not reviewed. Effectiveness of any awarded platform is unknown.","streamIds":["state-government"],"roles":{"sales":"Sales framing: North Carolina is buying frontier-model platforms directly from model owners, so integrator and reseller value shifts to implementation, integration, training and governance work around those platforms. A credible offer helps an agency or the state plan adoption under the contract: use-case intake, records and retention setup, and agent approval rules. Do not position this as a guaranteed spend vehicle; the contract is indefinite quantity and pricing tiers are not commitments.","engineering":"Engineering framing: map each RFP requirement to concrete controls before agencies onboard: SSO, U.S.-resident storage, export of prompts, outputs and audit logs to state security tools, and retention set by state schedules rather than vendor defaults. For agents, configure read-only or draft-only modes, approval checkpoints and delegated least-privilege identities, and run regression tests when models or prompts change. Expect more than one awarded platform and design shared logging across them.","delivery":"Delivery framing: the RFP bundles AI literacy, role-based training and adoption services, some at no cost to the state, so delivery planning should decide who owns training, how agencies request access, and how records officers sign off on retention. Build a records and public-records response runbook early, since the state's AI lead cited a tool that nearly launched without meeting those rules. Track adoption and incidents per agency from the first rollout."},"roleDetails":{"sales":{"customerProblem":"North Carolina agencies need a simple, approved way to buy secure GenAI tools and model APIs that meet public records, security and training requirements, instead of separate agency purchases.","stakeholders":["NCDIT Secretary and State CIO","State AI governance and policy executive","Statewide IT Procurement Office","Agency CIOs and records officers","Agency program leads requesting AI use cases"],"discoveryQuestions":["Which agencies plan to order first, and for which use cases?","How will agencies choose among multiple awarded platforms?","Who configures retention and handles public records requests for AI inputs and outputs?","What agent autonomy levels will the state allow at launch?"],"valueHypothesis":"Interpretation: a statewide multi-vendor contract with built-in records and agent controls could shorten agency procurement and reduce shadow tool use; no results exist yet.","potentialEngagement":"Bounded onboarding package for one agency under the awarded contract: use-case intake, retention and records configuration, agent approval rules and role-based training plan.","unsupportedClaims":["No platform has been awarded or tested","No guaranteed purchase volume","No evidence yet of productivity gains in North Carolina from this contract"]},"engineering":{"fit":"State enterprises standardizing GenAI assistants and model APIs across many agencies with strict records, residency and security rules.","architectureIntegration":"Seat-based assistant plus API access for state applications and agents; enterprise SSO; audit log export to state monitoring tools; tool connections through documented open standards; regression testing on model, prompt or knowledge-source changes.","prerequisites":["Enterprise identity provider integration","State retention schedules mapped to AI inputs and outputs","Security monitoring that can ingest platform logs","Data classification rules for what may be entered"],"constraints":["U.S.-only storage and processing","GovRAMP or FedRAMP status, or GovRAMP roadmap within two years","WCAG 2.1 AA accessibility","Only model-owning vendors may bid"],"security":"Least-privilege delegated identity for agents with time-limited authorization and revocation; prompt-injection and data-leakage testing; isolation of restricted legal data and disclosure of any model-training use.","proofOfValue":["Verify retention can be set to state schedules, including indefinite, and survives vendor defaults","Test export of prompts, outputs and audit logs for a sample public records request","Run an agent in draft-only mode with approval checkpoints and confirm cancellation works"]},"delivery":{"work":"Onboard agencies to the statewide GenAI contract: access requests, training, retention and records setup, agent controls and adoption tracking.","dependencies":["Contract award timing after Nov. 30 proposals","Vendor-provided training and adoption services","Agency records officers","State security operations integration"],"ownership":"NCDIT owns the statewide contract and governance; each ordering agency owns its use cases and records compliance.","skillsAdoption":"The RFP requires AI literacy and role-based upskilling; agencies need trained users and named AI leads before broad access.","governanceCheckpoints":["Use case reviewed under the Responsible Use of AI Framework","Retention configured and approved by records officer before go-live","Agent autonomy level approved before any write actions"],"acceptanceCriteria":["Proposed: retention and export verified for each platform before agency go-live","Proposed: all users complete required training before access","Proposed: agent actions logged and reviewable for every production agent"],"risks":["Multiple platforms fragment logging and records","Vendor defaults delete records the state must keep","Agents take actions beyond approved scope","Adoption lags without funded training time"]}},"retrievedAt":"2026-10-29T22:18:10-05:00","enrichedAt":"2026-10-29T22:22:19-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires WCAG 2.1 AA accessibility and bundles AI literacy and role-based training into the contract, treating workforce readiness as part of the purchase.","procurementImplications":"Direct-from-model-owner, multi-vendor, indefinite-quantity contract with tiered seat pricing and usage-based API pricing; resellers excluded from bidding but may fulfill orders. Three-year term with two optional one-year renewals.","operatingModelImplications":"Centralizes AI platform buying at NCDIT while leaving use-case ownership with agencies; multiple awards let agencies match platforms to use cases but require shared governance across vendors.","sourceVerification":{"openedUrl":"https://it.nc.gov/news/press-releases/2026/10/28/ncdit-issues-rfp-ai-platforms-services","referenceExcerpt":"By giving agencies a simpler path to secure, trusted AI tools, we can help our employees spend more time serving the people of our state.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}