From the State Government edition of October 29, 2026
North Carolina issues statewide multi-vendor RFP for enterprise GenAI platforms and frontier-model APIs, open only to model owners, with state-controlled retention for public records and configurable agent autonomy
North Carolina Department of Information Technology (NCDIT), Statewide IT Procurement Office · State enterprise IT procurement; generative AI platforms, model APIs and adoption services · North Carolina, U.S.
- Publisher
- North Carolina Department of Information Technology
- Original publication
- 2026-10-28 (NCDIT press release); RFP ITS-800000 issue date 2026-10-26; GovTech coverage 2026-10-29
- Source retrieved
- 2026-10-30
- Event date
- 2026-10-26
What happened
NCDIT issued RFP ITS-800000 on Oct 26 (announced Oct 28) to select multiple vendors for enterprise GenAI platforms, secure API access to their frontier models, and implementation, integration, AI literacy and role-based training for state agencies. Only vendors that own the frontier models may bid; resellers and companies building on others' models are deemed non-responsive, though resellers may fulfill orders later. Requirements include U.S.-only storage and processing, GovRAMP or FedRAMP status or a dated roadmap to GovRAMP authorization within two years, WCAG 2.1 AA accessibility, and state-configurable agent autonomy (read-only or draft-only modes, approval checkpoints, cancellation). Inputs and outputs are state data and may be public records; state retention schedules override vendor deletion defaults. Questions are due Nov. 9 and proposals Nov. 30; the term is three years with two optional one-year renewals. NC's AI governance executive told GovTech a tool once nearly rolled out before the state learned it could not meet public records requirements.
Why it matters
Why now: issued this week and not in our archive. It is one of the most detailed state procurement specifications yet for enterprise GenAI and agents, and it writes lessons states have learned (public records, retention, agent controls, training) directly into contract requirements. Other states building statewide AI contracts can compare their terms against it, and bidders have under five weeks to respond.
Evidence and measured results
Official press release opened in full; the RFP PDF opened and its scope, business and technical requirements, agentic functionality, public records and term sections read; GovTech report opened for the frontier-model definition and the state AI executive's comments. This is a solicitation: it shows what the state requires, not how any platform performs.
Limitations and uncertainty
A solicitation, not an award or outcome. Pricing schedules do not guarantee purchase volume. The reseller exclusion and frontier-model definition may change through addenda; an addendum notes modifications in Ariba that were not reviewed. Effectiveness of any awarded platform is unknown.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-29; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- North Carolina agencies need a simple, approved way to buy secure GenAI tools and model APIs that meet public records, security and training requirements, instead of separate agency purchases.
- Stakeholders
- NCDIT Secretary and State CIO
- State AI governance and policy executive
- Statewide IT Procurement Office
- Agency CIOs and records officers
- Agency program leads requesting AI use cases
- Discovery questions
- Which agencies plan to order first, and for which use cases?
- How will agencies choose among multiple awarded platforms?
- Who configures retention and handles public records requests for AI inputs and outputs?
- What agent autonomy levels will the state allow at launch?
- Value hypothesis
- Interpretation: a statewide multi-vendor contract with built-in records and agent controls could shorten agency procurement and reduce shadow tool use; no results exist yet.
- Potential engagement
- Bounded onboarding package for one agency under the awarded contract: use-case intake, retention and records configuration, agent approval rules and role-based training plan.
- Unsupported claims
- No platform has been awarded or tested
- No guaranteed purchase volume
- No evidence yet of productivity gains in North Carolina from this contract
Pre-sales engineering
Role takeaway
- Fit
- State enterprises standardizing GenAI assistants and model APIs across many agencies with strict records, residency and security rules.
- Architecture and integration
- Seat-based assistant plus API access for state applications and agents; enterprise SSO; audit log export to state monitoring tools; tool connections through documented open standards; regression testing on model, prompt or knowledge-source changes.
- Prerequisites
- Enterprise identity provider integration
- State retention schedules mapped to AI inputs and outputs
- Security monitoring that can ingest platform logs
- Data classification rules for what may be entered
- Constraints
- U.S.-only storage and processing
- GovRAMP or FedRAMP status, or GovRAMP roadmap within two years
- WCAG 2.1 AA accessibility
- Only model-owning vendors may bid
- Security
- Least-privilege delegated identity for agents with time-limited authorization and revocation; prompt-injection and data-leakage testing; isolation of restricted legal data and disclosure of any model-training use.
- Proof of value
- Verify retention can be set to state schedules, including indefinite, and survives vendor defaults
- Test export of prompts, outputs and audit logs for a sample public records request
- Run an agent in draft-only mode with approval checkpoints and confirm cancellation works
Delivery
Role takeaway
- Work
- Onboard agencies to the statewide GenAI contract: access requests, training, retention and records setup, agent controls and adoption tracking.
- Dependencies
- Contract award timing after Nov. 30 proposals
- Vendor-provided training and adoption services
- Agency records officers
- State security operations integration
- Ownership
- NCDIT owns the statewide contract and governance; each ordering agency owns its use cases and records compliance.
- Skills and adoption
- The RFP requires AI literacy and role-based upskilling; agencies need trained users and named AI leads before broad access.
- Governance checkpoints
- Use case reviewed under the Responsible Use of AI Framework
- Retention configured and approved by records officer before go-live
- Agent autonomy level approved before any write actions
- Acceptance criteria
- Proposed: retention and export verified for each platform before agency go-live
- Proposed: all users complete required training before access
- Proposed: agent actions logged and reviewable for every production agent
- Risks
- Multiple platforms fragment logging and records
- Vendor defaults delete records the state must keep
- Agents take actions beyond approved scope
- Adoption lags without funded training time
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
The specification assumes both a seat-based assistant and API access for state applications, chatbots and agents, with SSO integration, audit logs exportable to state security tools, Model Context Protocol-style tool connections, and regression testing when models, prompts or knowledge sources change. Multi-vendor award means agencies may run more than one platform, so identity, logging and records integration must work across them.
Governance
Who approves, reviews and stays accountable for outcomes?
Tools bought under the contract must operate within the N.C. Responsible Use of AI Framework and Executive Order 24. The RFP turns governance into bid requirements: configurable agent autonomy and approval steps, least-privilege delegated identity for agents, retention and legal hold under state control, and responsible-AI and accessibility responses.
Security and privacy
What data, permissions and controls need testing?
U.S. data residency is a certify-or-fail requirement; vendors must describe authorization status and hosting environment, prompt-injection and data-leakage testing, and handling of restricted legal data, including whether it is used for model training.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Requires WCAG 2.1 AA accessibility and bundles AI literacy and role-based training into the contract, treating workforce readiness as part of the purchase.
Procurement
What should contracts, pricing and exit terms secure?
Direct-from-model-owner, multi-vendor, indefinite-quantity contract with tiered seat pricing and usage-based API pricing; resellers excluded from bidding but may fulfill orders. Three-year term with two optional one-year renewals.
Operating model
Which teams own the service once it runs?
Centralizes AI platform buying at NCDIT while leaving use-case ownership with agencies; multiple awards let agencies match platforms to use cases but require shared governance across vendors.
Publication history
- 2026-10-29State Government · Issue 522 resources
Stable resource ID: north-carolina-ncdit-rfp-800000-statewide-genai-frontier-model-platforms-20261028