How to Fill Out and Submit SIMM 71B: Signatures, GenAI, and Filing

SIMM 71B is the California certification form a state entity signs to confirm that an IT acquisition complies with statewide technology policies, and a signed copy must accompany every purchase of IT hardware, software, services, or interagency IT agreement costing $5,000 or more before any work on that acquisition begins.¹ It is not an annual filing. You prepare a new SIMM 71B for each qualifying acquisition and for each amendment to that acquisition.²

When You Need to File One

The $5,000 threshold is the trigger. Any IT acquisition at or above that cost — servers, cloud subscriptions, consulting engagements, software licenses, interagency IT agreements — requires a signed SIMM 71B in the procurement package. The same requirement applies when you forward an acquisition to the Department of General Services Procurement Division (DGS/PD), when you ask DGS/PD to review a Non-Competitive Bid justification, and when you request a transaction-based increase in IT purchasing authority.³

Three categories are exempt under SAM § 4819.41:¹

Any IT acquisition with a total cost under $5,000.
Telecommunications equipment used exclusively for voice communications.
Standalone Voice over Internet Protocol phone systems that do not interface with other systems on the network.

One important boundary: an acquisition that includes a generative AI component needs CDT approval regardless of dollar amount, so the $5,000 floor does not get you out of the process when GenAI is in play.²

Who Has to Sign

The form must be signed by the state entity’s Chief Information Officer, or by a member of management the CIO has specifically designated for the purpose. The signature has to be in hand before work on the acquisition starts.²

A second signature is required from the Agency Information Officer (or AIO designee) when the total cost exceeds either the entity’s assigned CDT Project Cost Delegation listed in SIMM § 15 or $1 million, whichever is lower.¹ Most large procurements will trigger that second signature.

Non-affiliated state entities (those not governed by an agency) send their certifications directly to CDT at ProjectOversight@state.ca.gov, and CDT shows approval by signing in the AIO signature block.²

How to Fill Out the Form

Download the current template from the California Department of Technology’s SIMM 71 page. The May 2025 version includes fields for generative AI disclosures.⁴ The companion document SIMM 71A has the detailed preparation guidance.²

Section 1: General Information

Enter the state entity’s name, the submission date, and the contact person’s name, title, email, and phone number. The contact does not have to be the agency head. It should be the person who can answer questions about the specific acquisition.⁴ If the acquisition involves generative AI, Section 1 also asks you to indicate the GenAI status by checking the box that matches your situation.

Section 2: Procurement Authority

Identify the procurement authority for the acquisition. The signatory will certify in Section 3 that this is accurate, so confirm it before you move on.

Section 3: Certifications

Section 3 is where the signatory affirms six statements about the acquisition:

The acquisition complies with the IT criteria and procedures in SAM § 4819.41.
The acquisition meets Government Code 11135, which applies Section 508 of the federal Rehabilitation Act, or qualifies for an exception.⁵
The procurement authority identified in Section 2 is accurate.
The acquisition is excluded from CDT’s IT Project Submittal and Approval Authority under SAM § 4819.32.
If the acquisition contains generative AI, it meets SAM § 4986.1 through 4986.13. Mark “N/A” if GenAI is not involved.
If the acquisition includes IT training, it meets SAM § 4854, and the entity has obtained a CDT exemption where necessary. Mark “N/A” if no IT training is included.

Each certification is a representation that the underlying compliance work is already done — the accessibility review completed, the procurement authority confirmed, the GenAI risk assessment finished.⁶ Signing without that work in place is the most common way agencies get into trouble on this form.

The GenAI Step You Have to Finish First

If any part of the acquisition includes generative AI, you cannot truthfully complete Section 3 until your entity has run the GenAI Risk Assessment on the separate SIMM 5305-F form. That assessment weighs privacy, security, transparency, and equity factors and assigns a risk level of low, moderate, or high.⁷

In Section 1 of the SIMM 71B, check the box that matches the result:

Moderate or high risk — CDT consultation is required before the solicitation can be released or a contract executed.
An amendment to a prior CDT consultation — provide the prior CDT case number.
Low risk — the assessment was completed and the result was low.
GenAI disabled — the assessment was completed, and the GenAI feature has been disabled or turned off.

For moderate- and high-risk acquisitions, your CIO and CISO must sign the risk assessment, and a GenAI subject matter expert from your department has to be available to facilitate the CDT consultation. The consultation is submitted through the CDT IT Service Portal as a New Technology Consultation and Assessment request.⁸

The IT Training Step

If the acquisition includes IT training, there is a prior step before you can honestly check that box in Section 3. State entities must first check whether CDT already offers equivalent training, including its leadership academies and specialized bootcamps, before procuring from an outside vendor. If CDT’s training is not feasible for your needs, submit a Training Exemption Service Request through CDT, obtain CIO or AIO approval, and wait for CDT’s written response before proceeding with the purchase.⁹ Keep a central file of granted training exemptions and related acquisition documents, since CDT can request them for audit.

Where to Send the Signed Form

Routing depends on cost and who processes the acquisition:

Agency-affiliated entities with acquisitions above the delegation or $1 million: submit to your governing agency for AIO approval, then include the signed form in the procurement package sent to DGS/PD or CDT as applicable.
Non-affiliated entities, or acquisitions under the delegation and under $1 million: submit directly to CDT at ProjectOversight@state.ca.gov for approval.
Acquisitions requiring CDT processing: after approval, send the form with the applicable transmittal document to TechnologyProcurements@state.ca.gov.
Acquisitions requiring DGS/PD processing: after approval, include the signed form in the procurement package sent to DGS/PD.

Original and electronically signed certifications are both acceptable. Either way, the signed form has to accompany the transmittal document for the specific IT acquisition transaction.²

Amendments and Record Retention

Keep a copy of every approved SIMM 71B in the procurement file for audit.³ When an acquisition is later amended, whether through a scope change, a cost increase, or an added GenAI component, prepare and sign a new SIMM 71B for that amendment. The original certification does not carry forward.²

1
California Department of General Services. Certification of Compliance With IT Policies – 4819.41
2
California Department of Technology. SIMM 71A Certification of Compliance With IT Policies Preparation Instructions
3
California Department of General Services. Certification of Compliance With State IT Policies – 1013
4
California Department of Technology. SIMM Section 71B Certification of Compliance With IT Policies
5
Section508.gov. State-Level Accessibility Law and Policy
6
California Department of General Services. SIMM 71B – Certification of Compliance With IT Policies
7
State of California. GenAI Risk Assessment Workflow at a Glance
8
California Department of Technology. Technology Letter 24-03
9
California Department of General Services. Information Technology Training and Employee Development – 4854