SBIR IP Protection: What the Bayh-Dole Act Actually Means for Your Startup

If you're a founder with a patent or proprietary technology considering an SBIR grant, you've probably asked the question that stops half of first-time applicants cold: "Will the government own what I build?"

The short answer: No. You keep your IP. SBIR intellectual property protection is built into federal law. The Bayh-Dole Act (35 USC 200-212) was specifically designed to ensure that small businesses retain ownership of inventions made with federal grant funding. The government gets a limited license to use your invention for government purposes. It does not get ownership, exclusivity, or the right to give your technology to competitors. But there are three compliance obligations most founders don't know about. Miss any of them, and the government can request that you hand over title to your inventions.

This guide covers exactly what Bayh-Dole requires, what it protects, and the specific steps you need to take -- before, during, and after your SBIR award.

SBIR Intellectual Property Protection: What Bayh-Dole Established

The Bayh-Dole Act is a 1980 federal law that gives small businesses and universities the right to own inventions they create using federal grant money. Before Bayh-Dole, the government retained ownership of most federally funded inventions. The result was predictable -- fewer than 5% of government-owned patents were ever commercialized.

Congress decided that private ownership drives commercialization better than government ownership. So Bayh-Dole flipped the default: the creator keeps the IP, and the government gets a license.

For SBIR applicants, this is the foundational legal framework. It applies to every SBIR and STTR grant from NIH, NSF, DOE, and most other federal agencies. (One notable exception: ARPA-H, which uses Other Transaction Authority and negotiates IP terms separately. More on that below.)

What Rights Does the Government Get in Your SBIR-Funded Inventions?

When you receive an SBIR grant and create an invention under that funding, the government gets a nonexclusive, nontransferable, irrevocable, paid-up license to practice the invention. Here's what each of those terms means in practice:

The bottom line: you can license, sell, manufacture, and commercialize your invention exactly as if no government funding were involved. The government can use it for its own purposes (think: a government lab running your software internally), but cannot commercialize it, sublicense it, or share it with private-sector competitors.

This is a significantly better deal than most founders expect. The government license is narrow by design.

3 Bayh-Dole Compliance Requirements Most Founders Miss

Here's where it gets real. Bayh-Dole gives you ownership -- but only if you follow three rules. Miss any of them, and the government can request that you transfer title to your inventions. This is not theoretical. It is the specific mechanism the government used against Harvard in 2025.

1. Invention Disclosure: The 2-Month Window

When an inventor at your company conceives of or reduces to practice an invention under the SBIR grant, you must disclose that invention to the funding agency within two months of the inventor's written report to your company's personnel responsible for IP matters.

What this means operationally:

• Set up an internal process for your team to report inventions in writing. An email to the CEO with "I think I invented something" counts as a written disclosure. The 2-month clock starts when that email is sent.
• Disclose to the agency through the iEdison portal (iedison.gov) -- the interagency system for Bayh-Dole compliance. Both NIH and NSF use it. DOD uses a separate reporting path for contracts.
• The disclosure must include enough technical detail to convey the nature and purpose of the invention, the funding agreement number, and the inventors' names.

What happens if you miss it: The government can send a written request for you to assign title to the invention. This is not a fine -- it's a loss of ownership. The government then owns the patent.

2. Title Election: The 2-Year Window

After you disclose an invention, you have two years to make a written election to retain title. If you don't affirmatively elect within that window -- or if a statutory patent bar date is approaching, within 60 days of that bar date -- you lose the right to retain title.

What this means operationally:

• File your title election through iEdison or through written notice to your program officer.
• Don't assume that disclosing the invention equals electing title. They are two separate steps. Many first-time awardees make this mistake.
• If you plan to file a patent, coordinate the election with your patent filing timeline. The election deadline and the patent bar date can collide.

What happens if you miss it: Same consequence -- the government can take title.

3. U.S. Manufacture Preference

Under 35 USC 204, products using your Bayh-Dole-covered invention must be substantially manufactured in the United States -- unless you get a waiver from the funding agency.

This mostly affects hardware and manufacturing companies. If you're a software company, you're generally in the clear (software is "made" wherever a server runs). But if your SBIR funds a physical product and you plan to manufacture overseas, you need to request a waiver before moving production offshore.

What happens if you don't comply: The government can exercise march-in rights (more on that below) or revoke your exclusive license to the invention.

How SBIR Data Rights Protect Your Technical Data and Software

Patent rights under Bayh-Dole are one layer of protection. Data rights are a separate, equally important layer -- especially for software companies, AI/ML startups, and anyone delivering technical documentation to a federal agency.

DOD SBIR Contracts: DFARS 252.227-7018

If you win a DOD SBIR (through AFWERX, DARPA, Army, Navy, or any DOD component), your award is a contract, not a grant. Contracts give the government broader baseline rights to technical data and software -- but the SBIR program has a specific carve-out.

Under DFARS 252.227-7018, SBIR awardees get a 20-year data protection period for technical data and computer software developed under the SBIR contract. During this period, the government cannot release your data to third parties without your permission.

Key details since the January 17, 2025 rule change:

• The protection period is now a fixed 20 years (previously 5 years, indefinitely extendable -- the new rule is simpler but not extendable)
• After 20 years, the government gets Government Purpose Rights -- not unlimited rights. This means the government can use your data for government purposes and can share it within government, but cannot release it commercially.
• You must mark your deliverables with the proper SBIR data rights legend. If you deliver technical data or software without the correct marking, you permanently lose the right to restrict government use. This is not fixable after the fact.

Civilian SBIR Grants: NIH, NSF, DOE

Civilian agencies issue SBIR grants, not contracts. Grants are generally more protective of the awardee's data rights because the government's baseline rights to technical data are narrower under grants than under contracts.

For NIH specifically, the 2023 Data Management and Sharing Policy requires a data management plan. But SBIR awardees have a specific carve-out: under the Small Business Act (15 USC 638), you can withhold proprietary data for up to 20 years post-award. This means you do not have to share your proprietary datasets, algorithms, or trade secrets through NIH data repositories -- despite what the data sharing requirement might suggest at first glance.

If you're an AI/ML or software founder, this matters more than you might think. Many founders see "data management and sharing plan required" on the NIH application and assume they'll have to publish their proprietary training datasets, model weights, or algorithm details. They won't. You still need to submit a Data Management and Sharing (DMS) Plan with your application, but for SBIR awardees, the plan can specify that proprietary data will be withheld under the Small Business Act carve-out. The plan should describe what data you will generate, how you will manage it, and what (if anything) you will share -- but it is entirely compliant to state that proprietary commercial data will be withheld for the statutory protection period.

NSF also requires a data management plan, but NSF's framework is less prescriptive for SBIR awardees than NIH's. The key for NSF: your data management plan should acknowledge the SBIR data protection provisions and clarify which outputs are publishable research results (shareable) vs. proprietary commercial data (protectable).

A common misconception: SBIR grants do not require you to open-source your code, publish your algorithms, or release your training data. The NSF POSE (Pathways to Open Source Ecosystems) program exists for companies that voluntarily want to build open-source communities -- it is a separate, optional program, not a condition of SBIR funding.

Can the Government Take Your Patent Through March-In Rights?

March-in rights (35 USC 203) allow the federal government to grant licenses to third parties on a Bayh-Dole-covered invention under four circumstances:

1. Non-use: The contractor hasn't taken effective steps to achieve practical application of the invention within a reasonable time
2. Health or safety: Action is necessary to address health or safety needs not reasonably satisfied by the contractor
3. U.S. manufacture: The contractor hasn't met the domestic manufacturing requirement and hasn't obtained a waiver
4. Agency needs: The contractor hasn't met requirements for public use specified by the funding agreement

The 45-year track record: From 1980 through 2024, the federal government never exercised march-in rights. Every petition was denied. This led most IP attorneys to call march-in rights "theoretical."

The 2025-26 shift: According to published reports, the Department of Commerce initiated a march-in proceeding against Harvard University in 2025, marking the first time the government moved to exercise march-in rights in Bayh-Dole's history. A subsequent Federal Circuit ruling in early 2026 further clarified patent-risk boundaries in government-sponsored R&D. (Sources: Federal News Network, law firm alerts from Foley Hoag, Crowley Law, and Wilson Sonsini.)

What this means for your startup: The Harvard case involved a large research university with documented compliance failures -- late invention disclosures, incomplete utilization reporting, and U.S. manufacture requirement violations. This is not a scenario that describes a well-run SBIR startup that files its disclosures on time and commercializes in the U.S. If you follow the three compliance requirements above, your march-in risk is low.

That said, the landscape has changed. March-in rights are no longer purely theoretical. If you're planning commercialization strategy for a Bayh-Dole-covered invention, it's worth consulting with an IP attorney who understands the current enforcement climate.

How IP Requirements Differ Across SBIR Agencies

Not all SBIR programs treat IP the same way. The differences matter for your application strategy.

One additional note for DOD applicants: If your technology involves defense articles, controlled technical data, or items on the International Traffic in Arms Regulations (ITAR) Munitions List, separate export control requirements apply. ITAR is not part of Bayh-Dole, but it affects who can work on your project, where the work can be performed, and what data can be shared with foreign national team members. If you're building dual-use defense technology, consult an export control attorney before applying.

The strategic takeaway: If you have strong patents but no publications, NSF and DOD are more natural first targets than NIH. If you have publications but no patents, NIH is more forgiving. If you're pursuing ARPA-H, get the IP terms in writing before you sign -- Bayh-Dole defaults don't apply.

Based on Cada's analysis of scoring patterns across agencies, the patent-vs-publication asymmetry catches many founders off guard. For example, a hardware startup with five provisional patents but no peer-reviewed publications would score well at NSF or DOD, where patents carry weight. But the same company would face a significant penalty at NIH, where publications are the primary credibility signal.

Your Pre-Application IP Readiness Checklist

Before you submit your first SBIR application, work through these steps:

1. File provisional patents before submission. If you have patentable inventions, file provisionals before you start writing the proposal. This protects your priority date and gives you something concrete to list in the application. Based on Cada's analysis, having patents filed materially improves competitiveness at NSF and DOD -- agencies where reviewers weight IP more heavily than NIH.

2. Set up an internal invention disclosure process. Even if it's just a shared document or email protocol, have a system for team members to report inventions in writing. The 2-month Bayh-Dole clock starts when they do -- so you want to know when it starts.

3. Register for iEdison. If you win, you'll need to report inventions through iEdison (iedison.gov). Registration takes time -- don't wait until you have an invention to disclose.

4. Review your abstract for proprietary information. SBIR abstracts are public. At NIH, your abstract appears on NIH Reporter. At DOD, your abstract may be publicly released. Never include proprietary technical details, trade secrets, or unpublished algorithm specifics in your abstract.

5. Know your agency's data rights framework. If you're applying to DOD, understand DFARS 252.227-7018 and the marking requirements. If you're applying to NIH, understand the data sharing plan requirement and the 20-year SBIR carve-out.

6. If STTR: negotiate the IP agreement with your university partner first. STTR requires a research institution partner, and that means splitting IP. Get the IP allocation agreement in writing before you submit. Key terms to negotiate: who owns background IP (what you bring to the collaboration), who owns foreground IP (what gets created during the grant), what licensing rights each party retains, and who controls publication timing. University technology transfer offices (TTOs) typically require 4-8 weeks to negotiate IP agreements, and some take longer. If you're planning an April or September SBIR deadline, start the TTO conversation at least 3 months beforehand. The most common sticking point is the university wanting exclusive or co-exclusive rights to inventions that your startup needs for commercialization. Push for your company to retain exclusive commercial rights with the university getting a nonexclusive research license -- this preserves your ability to raise venture capital without IP encumbrances.

7. Know what you'll put in the IP section of your Commercialization Plan. NIH SBIR applications require an IP strategy section in the Commercialization Plan. Have a clear answer for: what IP do you own today, what will you file during the grant, and how will you commercialize post-award.