Search nstenders nstenders-23-Board of Management Secure Online Portal
Board of Management Secure Online Portal
Closes in 14 days 09 Sep 2026 00:00 UTC
IT fit 60 Secure online portal development, feasible for small IT shop.
AI workability
Effort & value
982 h AI · 438 h human · 1,420 h total
Deliverable mix
agent · assisted · human
Dates
06 Aug
06 Aug
09 Sep
09 Sep
AI can perform the majority of the software delivery effort (~69%), but security clearance and client-facing roles prevent full autonomy.
Bid call: MAYBE AI can deliver ~69% of effort, but security requirements are unspecified and the shop lacks facility security clearance. If security clearance can be met via subcontractor or is only reliability status, this is a strong go. Otherwise, no-go. Need full solicitation documents before committing.
| Deliverable | Mode | AI share | Hours | Notes |
|---|---|---|---|---|
|
Requirements & Architecture
Gather portal requirements, define solution architecture, user roles, and data model. |
ai assisted | 60% | 100 | AI can draft BRDs and architecture; human workshops with CRA are needed to confirm scope. |
|
UX/UI Design
Design wireframes, prototypes, and accessible interface for document management workflows. |
ai assisted | 70% | 100 | AI generates design options and prototypes; human validation with users is required. |
|
Backend Development
Build authentication, document storage, search, permissions, sharing, editing, and annotation APIs. |
ai agent | 85% | 300 | AI can produce most backend code end-to-end with light human review. |
|
Frontend Development
Build browser and app-based interfaces for upload, view, search, print, share, download, edit, and annotate. |
ai agent | 85% | 250 | AI can generate the frontend and integrate with APIs; human review for UX polish. |
|
Security & Compliance Implementation
Implement authentication, RBAC, audit logging, encryption, and security controls. |
ai assisted | 50% | 120 | AI implements controls, but security-cleared human review and sign-off are mandatory. |
|
Testing & QA
Create automated tests, run QA cycles, and support user acceptance testing. |
ai assisted | 80% | 150 | AI can generate and run test suites; human UAT with CRA users is required. |
|
DevOps & Deployment
Set up CI/CD, cloud infrastructure, environments, and production deployment. |
ai assisted | 80% | 100 | AI automates pipelines; human oversight is needed for production access. |
|
Documentation & Training
Create user manuals, admin guides, and training material in English and French. |
ai agent | 90% | 80 | AI can draft and translate documentation with light human review. |
|
Data Setup & Migration
Configure initial document structure, user roles, and any data migration from existing sources. |
ai assisted | 70% | 60 | AI handles data transformation; human confirms business rules. |
|
Project Management & Stakeholder Communication
Manage schedule, communications, status reporting, and client relationships. |
human only | 10% | 100 | AI can draft status reports, but relationship management and decisions require humans. |
|
Security Clearance & Compliance Administration
Obtain and manage personnel security clearances and compliance paperwork. |
human only | 0% | 40 | Cannot be done by AI; requires cleared personnel and formal processes. |
|
Bid Submission & Contract
Prepare and submit bid via Canada Post Connect, sign contract, and handle legal/financial accountability. |
human only | 0% | 20 | Human-only legal and submission process. |
Risks
-
high
Security requirements unknown and shop lacks facility security clearance.
Mitigation: Request full solicitation documents; assess if reliability status is sufficient; partner with cleared subcontractor if needed. -
high
Missing detailed SOW and technical specifications.
Mitigation: Base estimate on notice-level scope; submit clarification questions before bidding. -
medium
Canada Post Connect submission process is mandatory and error-prone.
Mitigation: Assign human bid administrator; test Connect workflow before closing. -
medium
Lowest-price evaluation may favor larger incumbents.
Mitigation: Use AI-driven delivery to keep costs competitive while meeting all mandatory criteria. -
medium
AI-generated code may contain security vulnerabilities.
Mitigation: Perform human security review, automated scanning, and OWASP testing. -
medium
Short timeline from publication to closing.
Mitigation: Start immediately and use AI agents to accelerate documentation and development.
Human roles needed
- Contract sign-off and legal/financial accountability · 10% — Cannot be delegated to AI.
- Client workshops and stakeholder facilitation · 20% — CRA users need human interaction and trust.
- Security-cleared compliance and sign-off · 20% — Security requirements require cleared personnel.
- Project management and communication · 25% — Relationship management and decisions.
- User acceptance testing and business validation · 15% — Business users must approve functionality.
- Deployment and production operations oversight · 10% — Production access and accountability.
Why not more AI
- Cannot hold security clearance or sign compliance attestations.
- Cannot perform in-person client workshops or build stakeholder trust.
- Cannot submit bids through Canada Post Connect or sign contracts.
- Cannot provide professional/legal accountability for CRA.
- Requires human review for security-sensitive code and production deployment.
Suggested delivery stack
- React/Next.js or Vue frontend with TypeScript
- Node.js/Python backend (NestJS/FastAPI) with REST/GraphQL
- PostgreSQL for relational data; OpenSearch for full-text search
- S3-compatible object storage for documents
- Keycloak or Azure AD B2C for authentication and RBAC
- Docker + Kubernetes or managed PaaS for deployment
- GitHub Actions CI/CD with automated tests and security scanning
- AI-assisted development toolchain (Copilot/Cursor, agentic coding pipelines)
Requirements & compliance (8)
| Ref | Requirement | Kind | Compliance |
|---|---|---|---|
| Annex A / Statement of Work | Portal must be a browser- and app-based software as a service (SaaS) used to upload, store, view, search for, print, share, download, edit and annotate documents. AI can build this; human acceptance review required. |
mandatory | met |
| Statement of Work | Access for a maximum of forty (40) active users. Small scale; straightforward authentication and permission implementation. |
mandatory | met |
| Submission instructions | Bids must be submitted using the Connect service provided by Canada Post Corporation and delivered to the CRA Bid Receiving Unit at BRUg@cra-arc.gc.ca. Bids will not be accepted if emailed directly to this address. Process step for human bid administrator; not AI-automatable. |
mandatory | met |
| Language | Proposal documents and supporting information must be submitted in either English or French. AI translation and refinement can produce both languages. |
mandatory | met |
| Security | There are security requirements associated with this requirement; consult the bid solicitation document. Details missing; no facility security clearance is a potential blocker. |
mandatory | unclear |
| Eligibility | This solicitation is open only to Canadian suppliers and to suppliers of an applicable trading partner. Shop is Canadian. |
mandatory | met |
| Evaluation | A bid must comply with the requirements of the bid solicitation and meet all mandatory evaluation criteria to be declared responsive. Need full compliance; no partial credit. |
mandatory | met |
| Contract options | Includes options to extend the term of the contract by up to six additional one-year periods under the same terms and conditions and to add, remove or modify products or services. Contract term flexibility; no impact on AI workability. |
other | met |
Evaluation criteria & key dates
- Mandatory evaluation criteria · Pass/fail — All mandatory criteria must be met; non-responsive if any fail.
- Price · Lowest bid evaluation price — Award to lowest responsive bid, subject to pre-award conditions.
- 2026-08-06T00:00:00+00:00 — Publication
- 2026-09-09T14:00:00-04:00 — Closing Date
Assumptions & gaps
Assumptions
- The portal is a greenfield SaaS build with no legacy integration constraints.
- Security requirements are limited to personnel screening, not facility clearance, but this is unverified.
- CRA will provide content/access requirements during workshops.
- AI agents can operate under human supervision for code and documentation.
- Total effort estimate is based on notice-level scope; actual SOW may change.
Gaps in source documents
- Full bid solicitation and security requirements checklist not provided.
- No estimated contract value or pricing structure.
- No detailed technical requirements, integrations, or accessibility standards.
- No information on existing CRA infrastructure or identity provider.
- No evaluation weight/price formula beyond lowest price.
- No information on data residency or hosting location requirements.
Deep read covered 1 captured document.
Draft proposal
Generate a first-draft bid response from the AI-workability dossier — approach per workstream, compliance responses, team model, pricing structure, and an honest gap list. Human review required before submission.
- Buyer
- Canada Revenue Agency (CRA)
- Type
- provincial
- Location
- Canada
- Notice type
- —
- Published
- 06 Aug 2026
- Closes
- 09 Sep 2026 00:00 UTC
- GSIN
- —
- UNSPSC
- —
Extracted document text
notice-page.txt
1000566272 - Board of Management Secure Online Portal 1000566272 - Board of Management Secure Online Portal This solicitation is OPEN Select a tab Notice Categories Documents (2) Notice Categories Documents 2 Mail Basic Information Reference Number cb-667-27874195 Issuing Organization Canada Revenue Agency (CRA) Solicitation Type RFP - Request for Proposal (Formal) Solicitation Number 1000566272 Title Board of Management Secure Online Portal Source ID PWGSC Agreement Types Canada-Chile Free Trade Agreement (CCFTA) Canada-Colombia Free Trade Agreement Canada-European Union Comprehensive Economic and Trade Agreement(CETA) Canada-Honduras Free Trade Agreement Canada-Korea Free Trade Agreement Canada-Panama Free Trade Agreement Canada-Peru Free Trade Agreement (CPFTA) Canadian Free Trade Agreement (CFTA) Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) World Trade Organization Agreement on Government Procurement (WTO-AGP) Canada-UK Trade Continuity Agreement (Canada-UK TCA) Canada-Ukraine Free Trade Agreement (CUFTA) Details Location Canada Dates Publication 2026/08/06 12:00:00 AM EDT Closing Date 2026/09/09 02:00:00 PM EDT Contact Information Marie-Claude Lepage marie-claude.lepage@cra-arc.gc.ca Description The Canada Revenue Agency (CRA) intends to enter into a contract with a single contractor for the provision of a secure online portal for its Corporate Secretariat with access for a maximum of forty (40) active users. The Portal must be a browser- and app-based software as a service (SAAS) used to upload, store, view, search for, print, share, download, edit and annotate documents. The Portal will be used by the CRA, its Board of Management, and other external committees (as required), and will be administered by the CRA’s Corporate Secretariat. The Portal will be a central repository for Board materials, documents and communication, thereby providing a secure and efficient environment to access materials and prepare for Board meetings. For additional information, consult Annex A, Statement of Work of the bid solicitation document. This requirement also includes options to extend the term of the contract by up to six additional one-year periods under the same terms and conditions and to add, remove or modify products or services. The estimated period of any resulting contract will be for one year from the date of contract award. A bid must comply with the requirements of the bid solicitation and meet all mandatory evaluation criteria to be declared responsive. The responsive bid with the lowest bid evaluation price will be recommended for award of a contract subject to pre-award conditions being met. Proposal documents and supporting information must be submitted in either English or French. Questions must be directed in writing to via email: Marie-Claude.Lepage@cra-arc.gc.ca Bids must be submitted by using the Connect service provided by the Canada Post Corporation. When responding, the proposal MUST be delivered to: Canada Revenue Agency Bid Receiving Unit BRUg@cra-arc.gc.ca Bids will not be accepted if emailed directly to this email address. This email address must be used to request that CRA open a Connect conversation, as detailed in Standard Instructions 2003. Bidders must not use their own licensing agreement for Connect to initiate a Connect conversation with CRA. The CRA reserves the right to negotiate with suppliers on any procurement. There are security requirements associated with this requirement. For additional information, consult the bid solicitation document. This solicitation is open only to Canadian suppliers and to Suppliers of an applicable trading partner. For additional information, consult the bid solicitation document. See more Disclaimer Government of Canada (GC) tender notices and awards, solicitation documents and tender attachments are available free of charge and without registration on canadabuys.canada.ca/en/tender-opportunities , the authoritative location for GC te
Documents
- text_saved