Phase III sole-source authority is the #1 watch item. You hold it today on the basis of FA8649-21-P-0756. Most firms in your position don’t know that. The statute doesn’t require Phase II. That changes the 18-month calculus.
Companies treat authorization as a finish line. It’s not. It’s a starting gun.
Most SBIR/STTR companies treat Phase II as required before Phase III. The law does not. 15 U.S.C. 638(r)(4)(B) authorizes federal agencies to issue Phase III awards, including sole-source awards, to the company that developed the technology, without further justification, without a J&A, and without a FAR Part 5 synopsis. The SBA Policy Directive (2019), Section 9, puts it in explicit parallel construction: a federal agency may enter into Phase III at any time with a Phase II awardee. Similarly, a federal agency may enter into Phase III at any time with a Phase I awardee. That word “similarly” is doing real legal work. CHN Analytics holds AFWERX STTR Phase I award FA8649-21-P-0756. That is the predicate. Phase III sole-source authority is already unlocked.
What the contracting officer needs is a memo for the record documenting the derives-from connection. No J&A. No competition. The memo covers three things: the Phase I award number and scope, the description of the new work, and one or two sentences explaining how the new work derives from, extends, or completes the Phase I effort. For Tech Vector, that sentence is not complicated. The Phase I verbatim scope was “discover a new method for identifying commercialization partners for government-funded research output using multiple, connected big data sets (patents, grants, financial) powered by artificial intelligence.” Tech Vector is the productized commercial implementation of exactly that method over the same data sources. The DERIVES FROM connection is textually direct. A CO who has seen Phase III actions before will recognize it in under ten minutes. A CO who has not seen Phase III before is the friction point, and the CO action memo we build addresses that directly.
Phase II remains an option. It funds prototype development, unlocks $2M+ in non-dilutive capital, and strengthens the pipeline. But it is not the gate before Phase III. Running Phase III pursuit and Phase II application in parallel is the right posture. Do not wait on Phase II before approaching your program office contacts about a Phase III sole-source. The statute does not require the wait. The waiting is a common-practice assumption, not a legal one.
Until January 2026, the FedRAMP 20x LI-SaaS pathway required a named agency sponsor to commit before authorization. That sponsor commitment was the bottleneck for early-stage products. As of the GSA rule change earlier this year, sponsorless authorization is now permitted. A CSP can go through 20x assessment, get FedRAMP-certified independently, enter the Marketplace, and then recruit sponsor agencies post-authorization. For NorthAI specifically, this means the path is no longer dependent on Office of Directed Energy committing pre-auth. ODE becomes a post-auth customer-sponsor, not a pre-auth gate.
Cost reality is worth naming directly. For Low-Impact LI-SaaS, recent published experience puts the range at $100-300K and 6-10 months wall-clock. For Moderate, the range jumps to $500K-$1.5M and 12-18 months. The 90-day assessment-only headline number does not reflect prep work. Based on published 3PAO pilot data, $250-400K and 6-9 months is realistic for LI-SaaS and optimistic for Moderate. Path selection should hold at LI-SaaS unless a buyer-specific requirement pushes higher. This watch item is #2, not #1, because the Phase III pathway can generate federal contract revenue without requiring FedRAMP at all. FedRAMP opens the civilian agency market and the SaaS subscription path. Phase III opens DoD direct-contract revenue now.
Before this letter shipped, we ran a verification pass against USASpending, FPDS, and SAM.gov to find the US prime that carried the 5.5-year OSI&A engagement. Working hypothesis going in: SOSi or Exovera, based on capability fit (open-source intelligence, ISR analytics, technology scouting). The result: zero public linkage. SOSi and Exovera have the right service-line description but no traceable OUSD R&E prime awards in the 2018-2023 window that would have carried a sub-of-prime arrangement at the scale needed.
This does not mean the relationship was not real. It means the public data is silent, which is consistent with how OUSD R&E sometimes structures contracts (technical assistance vehicles, broad-area-announcement work, indefinite-delivery contracts with task orders below FFATA reporting thresholds). The honest answer is: we don’t know who held your paper, and the only way to know is to ask you. That question is the most load-bearing one on the next call. If the relationship is warm, re-engaging the prime is the fastest Level 2 vehicle. If the relationship is cold but recoverable, the engagement absorbs the relationship rebuild. If the relationship is genuinely dead, the shape pivots toward GSA MAS and OTA/CSO motion building, which is a longer arc.
The investor pressure came up on the call: an hour before we spoke, an investor had asked “what are the no’s.” That question is the diligence community signaling that productization is the gating issue, not the technology. The multiples gap is the math behind that signal: pure services firms exit at 0.8-1.2x EV/Rev. Tech-enabled services exit at 1.5-3x. SaaS with growth and retention exits at 4-12x. The recurring-revenue percentage is the single number that anchors which band you’re in.
What we’d be tracking weekly: the recurring-revenue percentage as the first Level 2 SKU contracts come in, the labor-cost-to-revenue ratio (target: from roughly 70% today toward 60% by end of FY26), and the leading indicators of customer expansion (NPS proxies, second-contract renewal signal, deal velocity on the second SKU). This watch item dropped from the top of the list because the raise diligence artifact is downstream of the contract vehicle play. First vehicle, then recurring-revenue signal, then raise conversation.
Three signals that would change the engagement’s direction. First, the competitive flank: Govini has roughly a hundred million in ARR and FedRAMP High; if they extend downmarket into the unclassified strategy-intelligence segment NorthAI occupies, the white space gets crowded fast. We size the defensible window at 18 to 24 months. Second, the international vector that came up on the call: Five Eyes counterparts (UK DSTL, Australian DST, Canadian DRDC) are the credible 18-month expansion vector once US authorization clears. Third, the Series A timing itself, which is driven by the recurring-revenue mix and the FedRAMP milestone, in that order.