Not all SBIR programs protect your intellectual property the same way. NIH cares about publications. NSF cares about patents. DOD gives you 20-year data rights under DFARS. And ARPA-H doesn't even use Bayh-Dole -- it operates under Other Transaction agreements where IP terms are negotiated, not statutory.
If you're a founder comparing SBIR agencies, understanding how data rights differ should be part of your decision. Choosing the wrong agency could mean 40-80 hours invested in a proposal that conflicts with your commercialization strategy. This guide maps the IP differences across NIH, NSF, DOD (AFWERX/DARPA), DOE, and ARPA-H -- side by side, in one place.
Why Do SBIR Data Rights Differ by Agency?
SBIR data rights vary by agency because each agency uses a different funding instrument -- grants, contracts, or Other Transaction agreements (OTAs). The instrument type determines which IP framework applies: Bayh-Dole Act (grants), DFARS data rights clauses (DOD contracts), or negotiated terms (OTAs).
The Bayh-Dole Act (35 USC 200-212) is the default framework for most SBIR awards. It lets small businesses retain ownership of inventions made with federal funding, subject to specific obligations. But "most" is not "all" -- and the obligations themselves differ by agency.
Here's what you need to know before choosing where to apply.
The Quick-Reference Comparison Matrix: SBIR Data Rights by Agency
This is the core reference. Bookmark it.
| Dimension | NIH | NSF | DOD (AFWERX) | DOD (DARPA) | DOE | ARPA-H |
|---|---|---|---|---|---|---|
| Funding instrument | Grant | Grant | Contract | Contract/OT | Grant | Other Transaction (OT) |
| Bayh-Dole applies? | Yes | Yes | Yes (via DFARS) | Yes (contracts) / Negotiated (OTs) | Yes | No -- IP negotiated per agreement |
| Data rights protection | 20 years (SBIR carve-out, 15 USC 638) | 20 years (SBIR carve-out) | 20 years (DFARS 252.227-7018, updated Jan 2025) | 20 years (contracts) / Negotiated (OTs) | 20 years (SBIR carve-out) | Negotiated -- typically Government Purpose Rights |
| Data sharing mandate | DMS Plan required (SBIR can withhold proprietary data) | Data Management Plan encouraged | Technical data deliverables required | Varies by program | Data Management Plan required | No plan required in Solution Summary |
| Publication policy | No restrictions. Missing publications: -15 scoring penalty | No restrictions. Missing publications: -5 penalty | Abstracts may be public. ITAR may restrict publication | Program-specific | No restrictions | No restrictions |
| Patent scoring weight | No explicit penalty for missing patents | -5 penalty for no patents (Cada analysis) | -5 penalty for no patents (Cada analysis) | Varies | Varies | Patents are an "innovation indicator," not scored |
| Abstract confidentiality | Public (NIH Reporter) | Public | Public (may be publicly released) | Public (often classified programs have separate rules) | Public | Public |
| Special IP provisions | iEdison required. Commercialization Plan IP section (5 elements). STTR needs pre-submission IP agreement. | PI must be U.S. citizen or permanent resident. Innovation A/B/C classification. | ITAR gate (can block application). FOCI gate. Must mark data with SBIR legend -- unmarked = permanent loss. | DARPA BAAs have unique IP terms per solicitation. | iEdison required. U.S. manufacture preference. | HQ10 misuse mitigation required. Milestone-based payments. |
How to read this matrix: Each column represents one agency's SBIR program. Each row represents one IP dimension. Scan across a row to compare how agencies handle a specific issue. Scan down a column to understand one agency's full IP profile.
Scoring penalties reflect Cada's internal scoring calibration across 100+ proposals and 30+ agencies. These are not official agency numbers -- they're practitioner estimates based on observed review patterns. See methodology note at the end of this guide.
What Does Bayh-Dole Actually Mean for SBIR Founders?
The Bayh-Dole Act (35 USC 200-212) lets you keep ownership of inventions you develop with federal grant money. That's the headline. But it comes with obligations that trip up first-time SBIR founders.
Here are the key requirements:
Disclosure: You must disclose inventions to the funding agency within 2 months of the inventor's written report to your IP-responsible personnel. For NIH, NSF, and DOE, disclosure happens through iEdison. Missing this deadline means the government can request title transfer.
Title election: You have 2 years from disclosure to elect title in writing. Disclosure and title election are two separate steps -- founders often conflate them.
Patent filing: You must file a patent application within 1 year of electing title, or before any patent bar date, whichever is sooner.
Government license: The government retains a nonexclusive, nontransferable, irrevocable license to practice the invention. This license is limited to government purposes -- it does not extend to commercial applications or competitors.
Patent marking: All patents on Bayh-Dole-covered inventions must include: "This invention was made with government support under [award number] awarded by [agency]. The government has certain rights in the invention."
U.S. manufacture: Products must be substantially manufactured in the U.S. (35 USC 204). Hardware companies must plan for this. Software companies are generally exempt.
Annual utilization reports: Due January 31 each year for every subject invention where you elected title.
The ARPA-H exception: ARPA-H uses Other Transaction agreements, not grants or contracts. Bayh-Dole does not automatically apply. IP terms are negotiated per agreement. Performers typically retain IP rights with the government receiving Government Purpose Rights -- but "typically" is not "always." Read your OT agreement carefully.
Agency Deep Dives: The IP Rules That Catch Founders Off Guard
NIH: Publications Matter More Than Patents
NIH is the largest SBIR funder, awarding approximately $1.2 billion annually across its 27 Institutes and Centers. For IP purposes, here's what makes NIH different.
Publications are the dominant credibility signal. At NIH, missing peer-reviewed publications carries a scoring penalty roughly 3x larger than at other agencies (-15 vs -5, based on Cada's analysis of 100+ proposals). NIH study sections are composed of scientists who value publication track records as evidence of research capability. A provisional patent helps, but publications carry more weight.
No explicit patent penalty. Unlike NSF and DOD, NIH does not penalize founders for lacking patents. Even a provisional filing signals seriousness, but its absence is not a scored criterion.
Data Management and Sharing Plan required. Since 2023, NIH requires a DMS Plan with all applications, including SBIR. But here's what many founders miss: the SBIR carve-out under 15 USC 638 lets you withhold proprietary commercial data for up to 20 years. You don't have to share training datasets, model weights, or algorithm details. Your DMS Plan can explicitly state that proprietary data will be withheld under the Small Business Act carve-out -- and that's fully compliant.
Commercialization Plan IP section. NIH SBIR requires a Commercialization Plan (12-page max) with a dedicated IP strategy section covering 5 elements: current IP status, planned filings, Bayh-Dole compliance plan, licensing strategy, and freedom-to-operate assessment. Reviewers notice when this section is vague -- it's a common gap for first-time applicants.
Abstract is public. Your NIH abstract appears on NIH Reporter. Never include trade secrets, unpublished algorithm details, or proprietary methodology in the abstract.
Strategic fit: If you have a strong publication record but no patents, NIH is your most natural starting point.
NSF: Innovation Classification Drives Everything
NSF SBIR uses a three-tier Innovation Classification system that directly constrains your score:
| Classification | Description | Score Constraint |
|---|---|---|
| A | New scientific principle or method | Floor: 7 out of 9 |
| B | Novel application of known science to a new domain | Floor: 5 out of 9 |
| C | Engineering optimization of existing approaches | Ceiling: 4 out of 9 |
This classification is the single most important determinant of NSF SBIR success. If your technology is classified as C (incremental improvement), your innovation score is capped at 4 regardless of how well you write the proposal.
Patents are "nice to have" but not blocking. Patent applications are optional supporting evidence at NSF. However, Cada's analysis shows a -5 scoring penalty for companies with no patents or provisional filings. For Class A and B innovations, corresponding IP claims signal that the innovation is defensible and commercially viable.
PI eligibility is strict. The PI must be a U.S. citizen or permanent resident, employed at least 51% by the applying small business during the award period. For STTR, the research partner must be a university, national lab, or 501(c)(3).
Broader Impacts is about your technology, not your outreach. At NSF SBIR, Broader Impacts measures how the technology itself benefits national interests -- not education programs or diversity initiatives. You must name a specific population, mechanism, and plausible scale. "Will benefit society" fails. "Could reduce diagnostic time by 40% for the 15M patients in rural health systems" passes.
Strategic fit: NSF rewards genuine scientific novelty. If your technology represents a new approach (not a better version of an existing one), NSF should be on your list.
DOD (AFWERX/DARPA): Data Rights Are Your Best Asset
DOD SBIR awards are contracts, not grants. This means DFARS data rights clauses apply, and they're some of the strongest IP protections in the federal system.
20-year data rights protection. Under DFARS 252.227-7018, SBIR data rights now provide 20 years of protection. This was expanded from the previous protection framework (which started at 5 years with provisions for extensions) effective January 17, 2025. During the protection period, the government cannot release your technical data outside the government without your permission.
After 20 years: The government receives Government Purpose Rights -- meaning they can use your data within the government and share it with government contractors for government purposes. They cannot release it commercially.
Mark your data or lose it permanently. This is the single most important DOD IP rule founders miss. You must mark all technical data deliverables with the SBIR data rights legend. Unmarked deliverables result in permanent, irrecoverable loss of data rights. There is no undo. Include this in your project management workflow from day one.
ITAR gate. If your technology involves defense articles, technical data, or services on the ITAR Munitions List, the ITAR compliance gate can block your entire application. If you have foreign nationals on your team working on ITAR-controlled technology, you need an exemption path documented before submission.
FOCI gate. Foreign Ownership, Control, or Influence is a separate compliance check. Companies that are majority foreign-owned or foreign-controlled face a CRITICAL gate. Companies with foreign investors or board members need to disclose via DSIP Volume 7.
Abstract: no proprietary information. DOD abstracts may be publicly released. Never include trade secrets or proprietary technical details.
Dual-use framing required. AFWERX proposals must address both commercial AND defense markets in separate paragraphs. Defense-only or commercial-only framing is a red flag. Missing dual-use framing is a critical gap that reviewers catch.
Budget constraints (AFWERX Open Topic): $75K maximum, 90 calendar days. Subcontractors under 33% of total cost. 7% profit/fee cap.
Strategic fit: If you need long-term data protection and have technology with both commercial and defense applications, DOD provides the strongest IP framework.
ARPA-H: Different Rules Entirely
ARPA-H is the newest health-focused agency, and its IP rules are fundamentally different from every other SBIR agency.
Other Transactions, not grants or contracts. ARPA-H uses OT agreements. This means Bayh-Dole does not automatically apply. There are no standardized DFARS data rights clauses. IP terms are negotiated per agreement.
Performers typically retain IP with Government Purpose Rights. The standard ARPA-H position is that performers keep their IP and the government gets Government Purpose Rights. But "standard" is not "guaranteed" -- read your specific OT agreement.
Milestone-based payments. Unlike cost-reimbursement grants, ARPA-H OTs often use milestone-based payment structures. Base period is typically $1M-$5M over 12-24 months, with option periods extending to $10M-$25M+.
No data sharing plan required. The Solution Summary (ARPA-H's 6-page proposal format) does not require a data sharing or data management plan.
HQ10 misuse mitigation required. Every ARPA-H submission must include an HQ10 section -- an analysis of how the proposed technology could be misused and how those risks will be mitigated. HQ10 stands for "Health Questions 10," the tenth required element in the Solution Summary. Missing HQ10 is a mandatory red flag that triggers revision.
The innovation bar is high. ARPA-H targets 10x improvements, not 10% optimizations. Incremental approaches don't clear the bar.
Strategic fit: ARPA-H offers maximum IP flexibility but is highly competitive and limited to health-focused technologies. If you want negotiable IP terms and are building transformative health technology, ARPA-H is worth exploring.
DOE: What We Know (and Don't)
Cada does not yet have a comprehensive DOE SBIR playbook, so we'll be transparent about what we know and what's still being mapped.
Bayh-Dole applies. DOE was an early Bayh-Dole adopter. Standard SBIR IP protections apply, including the 20-year data protection carve-out under 15 USC 638.
iEdison registration required. Like NIH and NSF, DOE uses iEdison for invention disclosure and reporting.
Data management requirements. DOE has specific data management expectations that vary by program office (EERE, ARPA-E, Fossil Energy, etc.). These are more prescriptive than NIH or NSF in some cases.
U.S. manufacture preference applies. DOE enforces the Bayh-Dole U.S. manufacture preference (35 USC 204). For hardware-focused clean energy technologies, this is a practical constraint -- plan your supply chain accordingly.
Frankly, DOE's SBIR IP landscape is more fragmented than NIH or NSF because different program offices operate with different expectations. We're building out this coverage -- for now, if you're targeting DOE, review the specific solicitation's IP provisions carefully.
How to Use This Matrix for Agency Selection
The comparison matrix is a diagnostic tool, not a ranking. Which agency fits you depends on your specific IP profile and commercialization strategy.
If you have strong patents but no publications: Target NSF or DOD first. Both agencies value IP maturity, and neither penalizes you as heavily for missing publications as NIH does (-5 vs -15).
If you have publications but no patents: Start with NIH. Publications are the primary credibility signal at NIH, and there's no explicit patent penalty. NIH is more forgiving of early-stage IP portfolios.
If you need maximum data protection: DOD's 20-year DFARS data rights (expanded January 2025) are the strongest in the federal system. But you must mark every deliverable -- unmarked data loses protection permanently.
If you want negotiable IP terms: ARPA-H's OT structure lets you negotiate IP provisions. This flexibility comes with trade-offs: the process is less predictable, and ARPA-H is limited to health technologies.
If you're building a multi-agency strategy: Different grants can protect different assets. Your drug discovery work might go through NIH (where your publications shine), while your diagnostic device goes through DOD (where you want DFARS data rights). A portfolio approach lets you match each technology to the agency with the best IP fit.
This is exactly what a grant roadmap does -- it maps your technology portfolio to agencies based on fit, including IP alignment. Most founders evaluate one agency at a time. The ones who win consistently evaluate three or four.
Frequently Asked Questions
What are SBIR data rights?
SBIR data rights protect technical data and computer software developed under an SBIR award from unlimited government use or public disclosure. Under the Small Business Act (15 USC 638), SBIR awardees can withhold proprietary data for up to 20 years. After the protection period, the government receives Government Purpose Rights -- the ability to use the data within the government, but not to release it commercially.
Does the government own my invention if I get an SBIR?
No. Under the Bayh-Dole Act, you retain ownership of inventions made with federal funding. The government gets a nonexclusive, nontransferable license to practice the invention for government purposes. This license does not extend to commercial applications. However, you must meet Bayh-Dole obligations (disclose within 2 months, elect title within 2 years, file patent within 1 year) or you risk losing title.
What happens if I don't mark my technical data properly?
For DOD contracts, failing to mark technical data deliverables with the SBIR data rights legend results in permanent, irrecoverable loss of data rights. The government treats unmarked data as having unlimited rights. There is no appeal process. This is the single most common IP mistake founders make with DOD SBIR awards.
Can I publish research from an SBIR grant?
Yes, for most agencies. NIH, NSF, DOE, and ARPA-H place no restrictions on publishing research from SBIR-funded work. DOD is the exception -- ITAR-controlled technologies may have publication restrictions, and you should coordinate with your contracting officer. Across all agencies, coordinate patent filings before publication to avoid creating prior art that could bar patent claims.
Do I need patents to apply for SBIR?
No. Patents are not required by any SBIR agency. However, they affect your competitiveness differently by agency. NSF and DOD apply a roughly -5 scoring penalty for companies with no patents (Cada analysis of 100+ proposals). NIH has no explicit patent penalty. At all agencies, even a provisional patent filing signals IP awareness and commercialization intent.
Next Steps
If you're not sure which agency fits your IP profile, that's the first question to answer -- before investing 40-80 hours in a proposal.
Cada's grant roadmap consultation maps your technology, IP portfolio, and commercialization strategy to the agencies where you're most competitive. Not just one program -- a multi-agency strategy that accounts for how each agency handles data rights, publications, and patents.
15 minutes. Straight answers. No pitch.
Book a free roadmap consultation
Cada has written 100+ grant proposals across 30+ agencies. The comparison data in this matrix is drawn from Cada's internal playbooks and scoring calibration -- not publicly available elsewhere. For the latest agency-specific rules, always verify against the current solicitation.