VOSB Certification + AI Tooling: What Counts as 'Owned'

VOSB and SDVOB certifications require that the veteran-owner not just own the business but also control it. The VA (since the SBA transition) evaluates control through specific factors. AI tools, automation, and outsourcing patterns can raise questions in verification.

This guide covers what AI usage means for your certification status. Not legal advice — talk to a VA-experienced attorney for your specific facts.

The control question

Control means the veteran-owner makes the long-term and day-to-day decisions for the business. The VA looks at:

• Who runs day-to-day operations
• Who signs contracts
• Who hires and fires
• Who makes financial decisions
• Whether the veteran has the technical experience to oversee what the business does
• Whether any non-veteran has disproportionate influence (a board member, a major creditor, a manager with operational authority that exceeds the veteran's)

AI is a tool that supports the veteran's decision-making, not an entity that exercises control. As long as the veteran owner is making the actual decisions, AI usage doesn't affect control determination.

Where AI usage raises questions

A few patterns where AI usage MIGHT raise verification questions:

1. AI making customer-facing decisions without veteran oversight. If an AI system makes contracting decisions, pricing decisions, or strategic decisions without veteran review, that's a potential issue.

The fix: ensure AI is a tool that surfaces decisions for human (veteran) approval, not an autonomous decision-maker.

2. Outsourced AI implementation that runs the business. If a non-veteran consultant or vendor effectively runs your AI-augmented operations, that vendor could be deemed to have outsized control.

The fix: clear consulting agreements with no ongoing operational control by the vendor. Veteran-owner retains all authority over operational decisions.

3. AI vendor concentration risk. If your business is critically dependent on one AI vendor with no fallback, the VA could (rarely) question whether you have genuine control over operations.

The fix: vendor redundancy where reasonable, and clear documentation that the veteran-owner makes the vendor decisions.

4. Subcontract patterns where AI capability is supplied by a non-veteran firm. If you're an SDVOB prime and the AI capability is essentially supplied by a larger non-veteran sub, the "ostensible subcontractor" rule could apply.

The fix: ensure the AI capability inside your business is genuinely yours — staff who work for you, tools you contract for directly, decisions you make. Subs can supplement; they can't be the substance.

What AI usage does NOT affect

To be clear, these patterns are fine:

• Using AI tools (Claude, ChatGPT, Copilot, etc.) as work aids
• Subscribing to AI software services (Inngest, Resend, Supabase, etc.)
• Hiring contractors to implement AI features
• Marketing your business as AI-augmented
• Using AI to draft proposals, communications, documentation
• Using AI for back-office work (accounting, scheduling, etc.)

None of these affect VOSB/SDVOB status if the veteran-owner remains in control of operations.

Specific scenarios

Scenario 1: Solo SDVOB consultant using AI heavily

You're a solo SDVOB consultant. You use Claude for drafting, Cursor for code, Notion AI for organization. AI is critical to your productivity.

Certification status: Fine. You're using tools. You make all decisions. AI is augmenting, not replacing, your work.

Scenario 2: SDVOB with non-veteran AI implementation contractor

You hired a contractor to build your AI implementation. They built it; they don't run it. You operate it day-to-day with your team.

Certification status: Fine. Construction-style contractor relationship. No ongoing control issue.

Scenario 3: SDVOB where AI does the customer-facing work

You're an SDVOB selling AI-augmented services. The AI does much of the customer interaction. You and your team supervise.

Certification status: Generally fine, provided you and qualifying staff are reviewing AI outputs and making operational decisions. The AI is a tool you use to deliver services. You're still the service provider.

Scenario 4: SDVOB where AI decisions are unsupervised

You set up AI to handle customer onboarding, sales follow-up, and service delivery decisions. The AI runs nearly autonomously.

Certification status: Potentially problematic. The VA might question whether you actually control day-to-day operations or whether the AI is doing it. The fix: ensure human oversight is real and documented, not just titular.

Scenario 5: SDVOB acquired AI capability through a non-veteran partner firm

You're an SDVOB prime. A non-veteran firm provides the AI capability behind your service delivery. They handle the AI; you handle the contract.

Certification status: Risky. The ostensible subcontractor rule could apply. If the AI is the substance and you're effectively a passthrough, the contract could be challenged. The fix: bring AI capability genuinely in-house, even if smaller in scope.

Documentation that helps

For verification or recertification, having documented:

• AI vendor list with contracts
• AI usage policies
• Human review and approval workflows
• Veteran-owner decision authority over AI-related choices
• Staff list with roles and clearances

This is documentation you'd want anyway. The same artifacts that support good operations support certification.

What VA verification actually looks at

VA verification reviewers look at:

• Business records (financials, contracts, payroll)
• Operational records (decision logs, hiring records)
• Veteran-owner activity (where they spend time, what they decide)
• Outside relationships (consultants, vendors, partners)
• Customer-facing presentation

AI usage rarely comes up directly. It comes up indirectly through some of the above (e.g., "what does this consultant do for you?"). If your AI relationships are clean and documented, this part of verification goes smoothly.

The annual update

Verified SDVOBs and VOSBs have annual confirmations. Update your records to reflect new AI tools and any new vendor relationships. Don't surprise verification with significant unreported changes.

What to do if you're a verified SDVOB / VOSB

Best practices:

1. Keep an "AI vendor inventory" alongside your other vendor lists. Helps with verification AND with general vendor management.

2. Document veteran-owner decision authority over AI tools. Quarterly: the veteran-owner explicitly reviews the AI tooling. Notes filed.

3. If you have substantial outsourced AI work, structure it as defined deliverables, not ongoing operational control by the contractor. Defined SOW. Defined termination.

4. Maintain meaningful in-house operation of AI. Even if you contract for build, you operate. Critical distinction.

5. Don't let any single non-veteran consultant become "the AI person" who runs everything. Spread the dependency.

What to do if you're considering certification

If you're a veteran owner who isn't yet certified and you're considering it:

AI usage in your business doesn't disqualify you. It can actually strengthen your application by demonstrating modern capability. Just structure operations so:

• You make decisions
• Your team operates AI tools
• Outside vendors deliver specific capabilities under contracts, not ongoing control

The certification process for SDVOB is at the VA's Office of Small and Disadvantaged Business Utilization (and the Center for Verification and Evaluation). VOSB and SDVOB processes are similar; SDVOB has the additional service-connected disability requirement.

The bottom line

AI usage is compatible with VOSB and SDVOB certification. The veteran-owner needs to genuinely control the business. AI is a tool that supports control, not an entity that exercises it.

The patterns that raise issues — autonomous AI decision-making, dominant non-veteran vendor relationships, passthrough subcontract structures — are operationally bad regardless of certification. Avoid them for business reasons; certification compatibility is a bonus.

Not legal advice. For verification or recertification, talk to a VA-experienced attorney.