How to register a small business on SAM.gov in 2026

Registering a small business for federal contracts and grants takes about two weeks from the first form to active status, and most of that is waiting. The work itself is about four hours if nothing goes wrong. This guide is mostly about the things that go wrong.

Every system here is free. If a website asks you to pay to register in SAM, leave it. Some companies charge hundreds of dollars to fill out a form you can complete yourself.

What you are registering for

There are four systems. SAM.gov comes first, and each of the others depends on your SAM registration.

1. 01SAM.gov issues your Unique Entity ID (UEI) and your CAGE code. Without an active SAM registration, the federal government cannot pay you for a contract or a grant.
2. 02Grants.gov is where federal grant opportunities are posted and where most grant applications are submitted.
3. 03SBIR.gov lists SBIR and STTR topics and issues an SBC Control ID, which every Small Business Innovation Research application requires at all 11 participating agencies.
4. 04Agency portals are used by agencies that run their own. The Department of Defense uses DSIP and the National Science Foundation uses Research.gov.

Contracts are advertised on SAM.gov and grants on Grants.gov. The two systems are separate, and neither shows the other's opportunities.

Before you start

Gather these in one place:

• Legal business name, exactly as your state registered it
• State file or entity number
• EIN, and the exact taxpayer name the IRS holds
• Formation date, the effective date on the state certificate
• Physical address where the business operates
• Bank routing and account number for award payments
• Five years of gross receipts
• Employee count

The physical address rule

SAM states it plainly on the form:

We do not accept a P.O. Box, virtual office, mailbox service, or co-working space for your physical address.

That excludes much of what small companies use. A mail-forwarding suite with a box number fails. A virtual office fails. A co-working desk fails even when you pay for it, because none of them is a place the business itself occupies.

Two things pass: a home address and a suite you lease for your sole use. If you use a mail service, decide early. The choice is your home or a leased office.

Privacy. You can hide a home address from SAM's public search, which is covered in step 8. Before you rely on that, check whether your state already publishes it. Texas lists officer addresses on the Public Information Report, which anyone can read. If your state already publishes your address, hiding it in SAM protects very little.

Your mailing address is separate and unrestricted. You can keep a mail service as your mailing address. The rule covers the physical address only.

Step 1: entity validation

Create a SAM.gov account through Login.gov and start a new entity registration. SAM matches your legal name, address and formation date against public records. If it cannot match them, you must upload documents.

Redact before you upload. Black out the account number and balances, and keep the bank name, entity name, address and statement period. Draw filled black rectangles, then export the PDF so the boxes flatten. A highlight hides nothing, and text under a box that was never flattened can still be selected and copied. Upload only the page you need.

Start date is the effective date on your state certificate, which can differ from the date on its cover letter. Use the certificate. Doing Business As (DBA) can stay blank. If your company holds several trade names, naming one tells SAM nothing useful, and any name you enter must match a filed certificate.

Validation usually takes a few business days, and sometimes longer. SAM issues the UEI when validation clears, before you finish the rest of the registration.

Step 2: taxpayer information

The IRS matches your legal name and EIN as a pair. Enter the taxpayer name exactly as the IRS holds it, which is the legal entity name. A trade name fails the match. The address here should be the one the IRS has on file, which can differ from your physical address. SAM does not check the address here. This step takes two to five business days.

Step 3: business types

Three fields matter more than they appear to.

Socioeconomic categories. Minority-owned (with the specific category), women-owned and veteran-owned are self-representations and need no certification. These boxes make you findable. Large prime contractors on bigger contracts carry subcontracting plans with goals for small, veteran-owned, service-disabled veteran-owned, HUBZone, small disadvantaged and women-owned businesses, and they search SAM for firms that help them meet those goals.

The programs that carry set-asides (8(a), HUBZone, WOSB and SDVOSB) each need separate SBA certification.

Step 4: financial information

Enter the bank details for award payments: routing number, account number and account type. Executive compensation applies only if, in your last fiscal year, at least 80% of your revenue came from federal sources and that federal revenue was $25,000,000 or more. Almost everyone answers No.

Step 5: legal proceedings

These are certifications subject to 18 U.S.C. 1001 and the False Claims Act. Answer honestly. A clean company answers No to most of them.

One deserves care: within the past three years, has the entity been notified of any delinquent federal taxes above the FAR threshold for which liability remains unsatisfied? The answer is Yes only when all three are true:

1. 01The IRS formally notified the entity, through an assessment or a notice
2. 02The amount exceeds the threshold in FAR 9.104-5, currently $15,000
3. 03It remains unsatisfied: unpaid, and outside any approved installment agreement you are current on

The question covers the entity and its EIN. For a pass-through entity such as an S corporation, income tax usually falls on the owner's personal return, which this question does not reach. If you are unsure, find out before you answer. Your accountant can tell you in one call, or you can open an IRS Business Tax Account online.

Step 6: goods and services

NAICS codes

NAICS codes classify what you do. Each code you list carries its own size standard, and SAM shows whether you are small under each one. On a contract, the code in the solicitation decides your size. Your primary code is how buyers find you and matters for SBA programs. A reasonable set for a software or AI company, with SBA size standards in average annual receipts:

These come from SBA's table effective March 17, 2023, which is still in force. SBA has two proposals open, from August 2025 and August 2026, that would change many of these figures and remove most exception rows. Check the current table before you certify.

There is no NAICS code for artificial intelligence. NAICS was last revised in 2022 and classifies a business by what it delivers. In federal procurement, an AI company is a software company.

Choose your primary code for visibility. Most federal software solicitations are issued under 541511, so that is where contracting officers and primes will look for you. Watch for exception rows. 541519 has an Information Technology Value Added Reseller exception with a 150-employee standard, and adding it can put an N in your small business column. If you do not resell hardware, leave it out. About eight codes are plenty. A long, scattered list reads as unfocused.

Product and Service Codes

Product and Service Codes (PSCs) are optional and more granular than NAICS, and contracting officers filter on them. Software and AI services sit in the D series:

The older D302, D307 and D399 codes were retired. If a code will not resolve, type the two-letter prefix into the picker to see what exists. Research and development work falls in the A series.

Business size

Employees means people on payroll, averaged over 24 months, part-time included. Contractors paid on a 1099 generally do not count.

Small Disadvantaged Business

If this question never appears, go back and check the profit structure field. All four tests must hold:

1. 01At least 51% owned by socially and economically disadvantaged US citizens
2. 02Each person claiming economic disadvantage has a net worth under $850,000 (excluding their ownership in the business, the equity in their primary residence and qualified retirement accounts), average adjusted gross income of $400,000 or less and total assets of $6,500,000 or less
3. 03Those individuals control the management and daily operations
4. 04The firm is small under the applicable size standard

Step 7: the remaining certifications

Most of this goes quickly.

Step 8: public search

During registration, SAM asks you to decide on this line: "I authorize my entity's non-sensitive information to be displayed in SAM public search results." Yes means anyone can find your record, address included. No hides it from public search, though federal government users can still find it and the record still appears in SAM's data extracts and API.

Opting out keeps you visible to federal agencies, which covers grants and SBIR. It hides you from prime contractors, who search SAM publicly for small and disadvantaged subcontractors to meet their subcontracting goals. Subcontracting is one of the few routes into federal work that needs no past performance, and opting out closes it. If your address is already public through state filings, opting out gains you little and costs you that route.

To change the setting after your record is active, start an update to your registration in your SAM Workspace.

Step 9: CAGE validation, and the email you will probably get

After you submit, the Defense Logistics Agency reviews the registration and assigns the CAGE code. Many registrations receive an automated email from CAGEReview@dla.mil asking for verification.

They usually ask for legal business name documentation dated within the last 12 months, from your Secretary of State or equivalent:

• A certificate of good standing
• Articles of organization or incorporation
• A screenshot of active status from the state registry, with your computer's date and time visible

DLA does not accept IRS documents or assumed name (DBA) certificates. A DBA certificate proves a trade name and says nothing about the entity. The 12-month rule catches anyone whose formation certificate is years old. The usual fix is a current screenshot or a freshly ordered certificate of good standing.

Co-location. DLA lists other companies registered with similar names and asks whether any are associated with you. Answer only what you know. Location type. They ask whether the address is a virtual office, business incubator, residential home office, rental suite or something else. Residential home office is a normal and acceptable answer. Point of contact. They check that the email is on your company's own domain and that the phone number reaches you. They may call it. DLA does not recommend a free email address when your company has its own domain, and it may decline to process a registration whose phone number does not work.

Writing the reply. Keep it short and factual, and answer each question in the order asked. Attach the document, and reply to their email so the whole exchange stays in one thread. If your mailing address differs from your physical address, explain it in one line before they ask, because it will appear on whatever you attach.

Step 10: active status

The status tracker shows five stages: validate entity, Unique Entity ID issued, registration submitted, TIN and CAGE validation, and active. Once your registration is active, you can receive federal awards. Keep these numbers together, because every proposal and registration asks for them:

Set a renewal reminder for two months before your registration expires. SAM registrations expire every year. A lapsed registration blocks every award until you renew, and renewals take time.

After SAM: Grants.gov and SBIR.gov

Grants.gov

This is a separate account, and it is free.

1. 01Register at Grants.gov through Login.gov, using your own name and your company email
2. 02Add an Organization Applicant Profile with your UEI, which pulls your entity from SAM
3. 03Request the Authorized Organization Representative (AOR) role, which is the role that can submit. If you are the E-Business POC, you receive the Expanded AOR role automatically.

The E-Business POC named in SAM approves AOR requests. Grants.gov recognizes you as the E-Business POC when the email and UEI on your Grants.gov account match the E-Business POC in SAM, and you can then approve roles for others. The old EBiz login was retired in January 2023.

SBIR.gov

SBIR.gov signs you in through Login.gov, the same as SAM.gov, and checks your email against the point of contact listed for your UEI in SAM. Registration issues your SBC Control ID. The company profile may be seen by agencies and partners, so describe what the company builds in two or three specific sentences. Employee count means people on payroll, as in SAM, and consultants do not count. The 8(a) application at MySBA Certifications uses a separate SBA login.

What registration does not give you

Registration means you can be paid. Finding the work and winning it are separate jobs.

A capability statement. This is one or two pages covering what you do, your UEI, CAGE code, NAICS codes and socioeconomic status, and why an agency should choose you. Primes and contracting officers ask for it constantly, and they usually want it the same day. Write it now.

A route around past performance. Prime contract competitions weigh past performance heavily, and new firms have none. Three routes work without it:

• SBIR and STTR, scored on technical merit and commercial potential. Phase I awards run up to $323,090 and Phase II up to $2,153,927. You keep the intellectual property and give up no equity.
• Sources sought notices, which are market research. A good response can decide whether the work is set aside for small business at all, and it takes only a few hours to write.
• Subcontracting to primes, who must meet small business goals and who carry the performance risk. It builds the record you lack.

Time. A serious SBIR Phase I proposal takes weeks. SBIR and STTR were reauthorized on April 13, 2026, and now run through September 2031. From fiscal year 2027, which began on October 1, 2026, each agency must set a limit on how many proposals one company may submit, and the limits are due within 90 days of the start of the fiscal year. One strong proposal is worth more than five thin ones.

The most useful step in SBIR is one almost nobody takes: contacting the topic author.

The Department of Defense publishes its topics in a pre-release window before the solicitation opens, and during that window you can ask the author questions directly. Once the solicitation opens, that door closes.

Programs to consider once you are registered

The short version

1. 01Settle the physical address first. A mailbox will not pass.
2. 02Gather the documents before you start.
3. 03Set the profit structure to For Profit, or the small business track disappears.
4. 04Answer the tax question honestly, and get the facts first.
5. 05Pick the primary NAICS code where buyers will look for you.
6. 06Average your receipts over five years, or annualize them by weeks in business if the company is younger.
7. 07Expect the CAGE email, and keep a current state document ready.
8. 08Register on Grants.gov and SBIR.gov as soon as you have a UEI.
9. 09Write the capability statement.
10. 10Set a reminder to renew.

Expect about two weeks from start to finish when nothing goes wrong, and plan for longer.