What the regulation actually requires before a T&M award, why AI programmes keep reaching for it, and when a preferred contract type becomes available instead
On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, and pay with no per-seat pricing — so you can deploy anywhere, from your own cloud to a fully air-gapped network.
Last updated:
FAR subpart 16.6 governs time-and-materials, labor-hour, and letter contracts. It treats all three as instruments of last resort, and the reasoning is stated plainly in the text.
A T&M contract may be used only when it is not possible at the time of award to accurately estimate the extent or duration of the work, or to anticipate costs with any reasonable degree of certainty. The contracting officer must sign a Determination and Findings establishing that no other contract type is suitable. The contract must include a ceiling price. And because a T&M contract provides no positive profit incentive to the contractor for cost control or labor efficiency, appropriate government surveillance is required.
AI services keep landing in this category, and usually for a defensible reason: the contractor is expected to build the platform as well as integrate it, and nobody can size that in advance.
This guide covers what the D&F must contain, what the ceiling does and does not protect, and the specific circumstance in which a preferred contract type becomes available — which is when the platform already exists and can be licensed.
The D&F must describe the market research conducted. For AI specifically, research more than two years old is likely to be wrong about what can be bought rather than built.
Distinguish the outcome the agency needs from the solution a contractor proposes. T&M is justified by uncertainty about effort, not by uncertainty about what you want.
Whether the workload can be processed outside the agency perimeter determines which architectures are viable and belongs in the requirement, not in evaluation.
Rights are governed by separate clauses. Decide what the agency must be able to operate and modify independently before the solicitation.
The D&F standard is that it is not possible to accurately estimate the extent or duration of the work. That is a statement about the work, and it changes when the thing being acquired already exists.
For AI infrastructure the answer has changed rapidly; re-run this rather than inheriting a prior conclusion.
The D&F must describe the market research conducted, establish that costs cannot be anticipated with reasonable certainty, and address why a cost-plus-fixed-fee term, other cost-reimbursement, incentive, or fixed-price arrangement is not appropriate.
The ceiling caps exposure. It does not create an efficiency incentive, which is why the regulation pairs it with a surveillance requirement rather than treating it as sufficient on its own.
The contract specifies separate fixed hourly rates that include wages, overhead, general and administrative expenses, and profit for each category of labor. Vague categories are where effort drifts upward in seniority.
Because the contract type provides no positive profit incentive for cost control or labor efficiency, government surveillance is required to give reasonable assurance that efficient methods and effective cost controls are being used.
For AI, an evaluation set with a threshold, drawn from agency data.
FAR 16.601 states that T&M provides no positive profit incentive to the contractor for cost control or labor efficiency. Every other requirement in the subpart — the D&F, the ceiling, the surveillance — exists to compensate for that.
An acquisition strategy resting on research about what AI products existed two years ago is likely to justify building something that can now be licensed.
Software and data rights are governed by separate clauses. Agencies regularly fund development and then discover they cannot modify the result without returning to the contractor.
Where a workload cannot reach an external network, only locally hosted models satisfy the requirement. This should be stated as a requirement rather than evaluated as a discriminator.
Acquiring a platform that already exists as a firm-fixed-price licence against a defined deliverable avoids the entire justification burden of subpart 16.6.
Legal and HCA review of the market research and alternatives analysis
Track cumulative invoiced value against ceiling by month
Monthly reporting of actual hours by labor category against the proposal
Acceptance test performed by government staff without contractor assistance
Consequence: The market research no longer reflects what can be bought, so the justification rests on a false premise.
Prevention: Re-run market research specifically for the platform portion of the requirement.
Consequence: The ceiling stops being an estimate of the work and becomes a spending target.
Prevention: Derive the ceiling from an independent government estimate of the effort.
Consequence: Exposure is capped while efficiency is not, which is exactly the condition the surveillance requirement addresses.
Prevention: Stand up the required surveillance with named authority and monthly review.
Consequence: The agency funds construction of a system it cannot independently operate or modify.
Prevention: Specify required rights in the solicitation and evaluate them.
ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.
Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours.
Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform.
Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ.
Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity.
1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.
ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.
See how ibl.ai deploys AI agents you own and control—on your infrastructure, integrated with your systems.