SBIR Phase I and Phase II Insurance Requirements by Agency

SBIR is a congressionally mandated program, and it sets aside a fixed share of federal R&D budgets for small businesses, spread across eleven participating agencies and totaling roughly $4 billion a year in non-dilutive awards. That money comes with conditions, and one of the least understood is insurance: a legally binding requirement written into the award instrument itself, not a side consideration left to the awardee's judgment.

What SBIR is and why insurance is a contract condition

Awards take the form of contracts, grants, or cooperative agreements, and which form an agency uses decides which federal rules govern the award. For contracts, the relevant rulebook is the federal acquisition regulations that govern government purchasing, and the subpart covering insurance sets out when a contracting officer has to require it. Phase II awards in particular are often structured as cost-reimbursement contracts, and that structure makes the FAR's insurance clause directly active: the contracting officer must specify coverage whenever the kind of work, the mixing of government and company property, or the ownership arrangement makes it necessary to protect the government's interest. The FAR sets a floor, not a ceiling, and agencies routinely add requirements on top of it. Phase I awards, being smaller and shorter, trigger this machinery less often, but "less often" is not "never," and the agency sections below spell out where Phase I still carries obligations. A company that treats its SBIR award like a grant with no strings will discover the insurance requirement at the moment the contract is signed, when there's no longer time to buy a policy without pushing back the start date.

The coverage lines that appear most often across SBIR awards

A handful of coverage types recur across agencies, and knowing them in advance makes the agency-by-agency comparisons that follow much easier to read. General liability covers bodily injury and property damage claims from a company's operations, and it's close to universal. Workers' compensation is required by state and federal law wherever employees do the work, regardless of which agency is funding it. Professional liability, often called technology errors and omissions, covers financial losses a customer suffers because of a software failure, an AI error, or a mistake in professional services, and it tends to matter most to companies building software or AI-driven products. Cyber liability covers data breaches and network intrusions, and it's showing up in more SBIR awards as federal cybersecurity rules tighten. If a company ships physical hardware, inland marine or equipment coverage has to protect it while it's in transit or sitting at a government site. Limits and triggers for each of these vary by agency, which is the entire reason a single off-the-shelf policy struggles to satisfy more than one program at a time. One requirement cuts across nearly every one of these lines: coverage usually has to be primary and non-contributory, with the awardee's policy paying out before any government or prime contractor policy kicks in, and the government typically has to be named as an additional insured on the policy. Both of those require specific endorsements that a standard commercial policy doesn't include by default, so a certificate of insurance missing either one gets rejected at contract execution even when every dollar limit is correct.

DOD: the largest SBIR program and its branch-by-branch variation

The Department of Defense runs the largest SBIR program in the federal government by dollar volume, and it does so through separate service branches and innovation offices, each one issuing its own award instrument and layering its own conditions on top of the FAR baseline. AFWERX, the Air Force's innovation arm, structures Phase I SBIR and STTR awards as FAR-based firm fixed price purchase orders, while Phase II awards can be executed either as FAR-based contracts or as Other Transaction Agreements, and OTAs can carry different insurance triggers than a standard cost-reimbursement contract. So a company needs to confirm the exact instrument type named in the solicitation rather than assume Phase I rules carry over to Phase II. The Army has gone further by making cybersecurity certification under CMMC topic-specific, so some Army SBIR topics demand a higher CMMC certification level and documented evidence of controls while others don't ask for it at all, and a company has to read each topic description rather than assume a standard cyber policy will clear the bar. On the general liability side, DOD contracts fall under FAR 28.307-2, which sets a floor of at least $500,000 per occurrence for bodily injury liability, though individual solicitations and installation-specific clauses frequently push past that floor, and Tech E&O and cyber coverage commonly carry meaningful limits of their own; flow-down requirements on DOD Phase III or production contracts can push limits well beyond what a Phase I or Phase II award ever required. The primary and non-contributory endorsement gets enforced most consistently here: a certificate lacking it will be turned away at execution no matter how high the underlying limits run. DOD Phase II awards are frequently cost-reimbursement instruments, so the FAR's bodily injury floor binds directly, but Phase I instrument type varies enough by branch and solicitation that a company has to confirm it case by case. Other branches and research agencies follow the same pattern of per-program variation, so a company has to check the program office and the individual solicitation.

NIH: grant instrument, Phase I limits, and the FOA

One major grant-funding agency runs most of its SBIR awards as grants rather than contracts, and it issues a smaller number as contracts for specific topic-driven solicitations. That distinction matters because FAR clauses, including Subpart 28.3, don't automatically apply to a grant. Where NIH does impose insurance requirements, they live in the NIH Grants Policy Statement, which gets folded into the Notice of Award, or in the Funding Opportunity Announcement itself, not in a FAR clause borrowed from contract law. Budgets for Phase I and Phase II follow NIH's standard agency limits, and submissions run on a fixed cycle: September 5, January 5, and April 5, with any date landing on a weekend or federal holiday pushed to the next business day. Competition for Phase I has tightened sharply, with selection rates down to roughly 8% as of FY2025, which makes NIH one of the most competitive single-agency SBIR programs in the federal system. In a field that competitive, a proposal that arrives with insurance or compliance questions unresolved is at a real disadvantage next to one that shows up fully ready. Because the specific insurance terms differ by institute and by topic, the FOA governing a given award is the authoritative document, and a company's job is to find the relevant clause there rather than assume a prior NIH award's terms will repeat. Companies performing the funded research at a university or hospital face a separate layer entirely: the institution's own risk management office often adds facility-specific insurance requirements on top of anything NIH asks for, and those have to be confirmed directly with the institution.

NSF: the most accessible entry point and its project pitch pre-step

One agency with a broad science and engineering mandate accepts a far larger share of applicants than the grant-funding agency described above, with a Phase I success rate running roughly 15 to 20%, and its broad mandate for commercial deep-tech work makes it a natural fit for autonomous systems, robotics, and AI hardware companies. Before NSF will accept a full proposal, applicants have to clear a Project Pitch stage, and the next full-proposal windows fall on July 27, 2026, November 4, 2026, and March 4, 2027. That pre-step stretches the overall timeline to award. The point at which insurance actually needs to be in place arrives later than it would at an agency that takes proposals directly. Phase I awards fund 6 to 18 months of feasibility work, and Phase II extends that to 24 months. NSF awards are grants rather than contracts, so insurance terms are written into the award terms themselves and the FAR Subpart 28.3 framework has no bearing on them. None of that removes the underlying exposure for a hardware company. If a Phase I NSF award leads to a prototype running at a customer's site, that creates real product and general liability exposure, even if NSF's own award terms never mention it, and the customer receiving that prototype will care a great deal, whether or not the funding agency did. Companies should raise coverage questions directly with NSF program officers before submission, which is consistent with NSF's broader encouragement to make early contact. That customer-side expectation is a separate problem from anything NSF requires, and it deserves its own treatment.

NASA, DOE, USDA, DOC, and DHS: how award size and mission shape the requirements

Two variables predict almost everything about what the remaining major SBIR agencies will ask for: how large the award is and how close the agency's mission sits to physical hardware. Agencies funding large, hardware-heavy work impose more extensive insurance stacks; agencies funding smaller, standards-oriented work ask for less. NASA raised its Phase I awards to $225,000 for FY2026, and because its mission runs through aerospace and space systems, hardware prototypes show up constantly in its funded work, making inland marine and equipment coverage directly relevant to anyone transporting or deploying hardware at a NASA facility. One mission-driven agency opened a substantial Phase II funding pool for companies with prior-year awards, runs solicitation windows in summer (July) and fall/winter (October through November), and structures many of its awards as contracts, which puts the federal insurance rules for contracts into play on cost-reimbursement instruments; its national lab partnerships add another layer, since individual labs set their own facility-specific insurance terms that have to be confirmed with the lab's own contracts office. USDA sits at the other end of the scale: its Phase I and Phase II award ceilings run well below most other agencies, its focus on food, agriculture, and rural development means hardware deployment is less common, and its insurance requirements track that lighter footprint, though workers' compensation and general liability remain standard regardless of award size. A pair of smaller mission-focused agencies runs among the smallest award ceilings in the SBIR system, comparable to or lower than USDA's at some phases, and at that funding level the award is often a grant with correspondingly lighter compliance demands, though the specific Funding Opportunity Announcement remains the document to check. DHS sets its Phase I and Phase II award levels in line with its homeland security mission, and because that work often touches sensitive systems or takes place at government facilities, it can trigger security and insurance requirements that go beyond the standard FAR baseline.

The harder insurance problem autonomous systems and robotics companies face

Satisfying an SBIR award's insurance checklist and actually being covered are two different things, and the gap between them is widest for autonomous systems and robotics companies. A company can hold the right policies, meet every stated limit, and get its certificate of insurance accepted by the contracting officer, and still find that the underlying policy excludes the claim the moment a sensor or an algorithm turns out to be the proximate cause of a loss. Standard general liability and tech E&O policies were built around a world where physical damage and software failure were separate categories of claim, so separate policies handled them. An autonomous logistics system that executes a command resulting in physical harm produces a claim that is simultaneously a general liability claim, because something was physically damaged, and a technology errors and omissions claim, because an algorithmic decision caused it, and a standard policy may exclude one leg of that claim or both. Insurers have started responding to that ambiguity by excluding AI-related losses. As of July 2026, more than 60 property and casualty insurance groups, including AIG and Great American Insurance Group, had filed with state regulators to adopt or delay-adopt AI-related exclusions, and AIG specifically stated it does not plan to implement them at this time. State regulators have approved the large majority of the exclusion filings they received. For hardware that runs autonomously, this produces a specific trap: a cyberattack against an autonomous robot that causes property damage can fall outside a property policy because of a cyber exclusion, while simultaneously falling outside a cyber policy because of a property damage exclusion, leaving the company holding two policies and no actual coverage for the one event that happened. Meeting an agency's stated insurance requirement confirms that a policy exists. It does not confirm that the policy responds to the specific way an autonomous system fails, and that distinction is where an SBIR awardee's real exposure sits.

What enterprise and government customers add to the SBIR baseline

The insurance terms written into an SBIR award are a floor set by the funding agency, not a ceiling set by the market the awardee is trying to sell into. Once a Phase I or Phase II prototype moves toward a pilot with an enterprise customer or a production contract with a government buyer, that customer sets its own insurance terms as a condition of doing business, separate from whatever NSF, NIH, or DOD required to get the award funded. Those terms tend to run well past the federal floor: enterprise customers deploying autonomous hardware on their own property routinely require proof of tech E&O and cyber coverage at limits the SBIR award itself never asked for, and government primes flowing down Phase III or production work add their own additional-insured and primary-non-contributory language on top of what the original award specified. A company that treats SBIR compliance as the finish line has only solved the easier problem, leaving the harder one of matching coverage to actual risk still ahead. Matching coverage to how an autonomous or robotic system actually fails and to what the next customer in line will demand starts only after the award is signed.