Independent · not GAO

How to file a GAO bid protest as a small business: deadlines, the $500 fee and common traps

Updated September 2026

A bid protest is a legal proceeding with short, strictly enforced deadlines, and one missed step can end it before GAO looks at the merits. Most examples below come from GAO decisions issued in August and September 2026, several involving small businesses that lost on a procedural step.

What are my options if I lost a federal contract or think a solicitation is unfair?

• Agency-level protest to the contracting officer or another official the solicitation names. The model text is at RFO 33.104-4, and agencies are to make best efforts to decide within 35 days.
• GAO protest through EPDS, under 4 CFR part 21. GAO's rules require a decision within 100 days.
• U.S. Court of Federal Claims, under 28 U.S.C. 1491, with its own rules. This page does not cover that route.

RFO citations here are FAR overhaul model text, which applies to an agency only once it issues a class deviation (acquisition.gov FAQs). Check which rules your solicitation uses before you count days.

Only an "interested party" may protest at GAO (4 CFR 21.0(a)(1)). That means an actual or prospective bidder or offeror whose direct economic interest the award, or the failure to award, would affect.

How long do I have to file a GAO bid protest?

GAO's FAQ says its timeliness rules turn on each case's facts and "are strictly enforced." Section 21.2 sets three clocks.

1. Solicitation terms. A defect apparent before bid opening or the deadline for initial proposals must be protested before that time. One added by amendment must be protested by the next closing time.
2. Everything else. Within 10 days after you knew or should have known the basis, whichever is earlier.
3. Required debriefings. In a competitive-proposal buy where a debriefing is requested and, when requested, is required, you may not file before the offered debriefing date and must file within 10 days after it is held.

That exception needs a required debriefing. Under the RFO Part 15 text, you must ask for one in writing within 3 days after receiving the award notice, and an agency that accommodates a late request does not thereby extend protest deadlines (RFO 15.301-1(a)).

Commercial buys using the simplified procedures in RFO 12.201-1 can reach $9 million, well above the simplified acquisition threshold. In those buys an unsuccessful quoter who asks gets a brief explanation, not a debriefing (RFO 12.301(b)). Section 21.2(a)(2) excepts only a required debriefing, so do not count on it to buy time.

How GAO counts days and the evening cutoff

Days are calendar days, and the day of the event is not counted. If the last day falls on a weekend, a federal holiday or a day GAO is closed, it rolls to the next day GAO is open (4 CFR 21.0(d)). A document counts as filed that day only if EPDS receives it by 5:30 p.m. Eastern (21.0(g)).

Oready, LLC protested the terms of three Bureau of Indian Education quote requests due May 15, 2026, at 5:00 p.m. Mountain time (7:00 p.m. Eastern). Its protests arrived after GAO's 5:30 p.m. close, so they counted as filed Monday, May 18, too late. GAO dismissed them on June 8, 2026, noting that as a general matter, when GAO will be closed at the closing time, a solicitation protest is due by 5:30 p.m. Eastern on its last open day before closing. It denied reconsideration in B-424508.2 et al. (Sept. 10, 2026).

What does it cost to file with GAO, and do I need a lawyer?

GAO's File a Bid Protest page sets the fee at $500 from October 1, 2024. The EPDS Instructions (September 2024) apply it to each new protest, but not to supplemental protests, reconsideration requests or cost requests. It is non-refundable even if you win, though GAO may recommend the agency reimburse it with your other protest costs (4 CFR 21.8).

GAO's bid protest FAQ says filing "does not require the services of an attorney." The trade-off is the record.

Only attorneys admitted to a protective order see protected material (21.4(a)). GAO's FAQ adds that those attorneys may not share it with their clients, and that attorneys engaged in a party's competitive decision-making are not eligible. Without counsel, you get redacted documents that must adequately explain the agency's arguments, and GAO reviews the rest privately (in camera).

GAO also generally will not issue a protective order where the winner, as intervenor, has counsel and you do not. A.B. Martin Services, a small business protesting a $220,787 Defense Health Agency purchase order, had no counsel, so it saw only a redacted report (B-424616, Sept. 21, 2026).

How do I file in EPDS, and what if it is down on deadline day?

Every new protest must go through EPDS (21.1(b)), and the EPDS Instructions add three points.

• Filing is not complete until you pay. A new protest is not filed until every required portal field is complete and the fee is paid. GAO grants no extension for delays other than an EPDS technical failure.
• Dormant accounts lapse. Passwords expire after 121 days without access, and accounts are deactivated after 243. A lapsed account generally will not excuse a late filing.
• The outage procedure is specific. If EPDS fails during its normal operating hours (GAO aims for 8:00 a.m. to 5:30 p.m. Eastern on weekdays, excluding federal holidays and days GAO is closed), confirm with GAO, email the filing to protests@gao.gov with courtesy copies to the other parties, describe the error (proving the outage is your responsibility, so include a screenshot), and refile the identical document in EPDS by close of business on the second day after.

Sensis Inc., a small business, was told of a Secret Service set-aside award on July 22, so its deadline rolled from Saturday, August 1, to Monday, August 3. A systemwide EPDS email error blocked the temporary password it needed, and GAO accepted that EPDS was unavailable to it.

But Sensis emailed protest@gao.gov, singular, at 3:48 p.m., with no courtesy copy to the agency. GAO dismissed the protest as late in B-424694.7 (Sept. 14, 2026): "Filing is not accomplished by emailing a protest document to any other address in GAO." A phone call with GAO staff did not change that, so set up your account early and file a day ahead.

What has to be in the protest so it is not dismissed?

No formal briefs are needed, but 21.1(c) requires your contact details and signature; the agency and solicitation or contract number; a detailed statement of the legal and factual grounds, with relevant documents; proof that you are an interested party and timely; a specific request for a ruling by the Comptroller General; and the relief you want. Within 1 day after filing, a complete copy must reach the person the solicitation designates (or the contracting officer), and the protest must say so (21.1(e)). Put your dates in the first filing, because timeliness facts cannot be added for the first time on reconsideration (21.2(b)).

Speculation is not a ground

SkyMate, Inc. protested NOAA's reaffirmed award of a set-aside blanket purchase agreement, arguing the agency "may have" used unstated criteria, without first asking for a brief explanation of the reevaluation. GAO dismissed it as legally and factually insufficient, noting that the protester bears "the burden of presenting sufficient evidence" (B-424591.2, Sept. 17, 2026). Ask for the explanation quickly, and do not let the 10-day clock run while you wait.

Raise every ground on time

A.B. Martin raised a new argument in its August 6 comments. The agency had denied its agency-level protests on June 15, so that ground was due at GAO within 10 days of the denial, and GAO dismissed it as piecemeal.

Should I protest to the agency first, and does that pause the GAO clock?

Not exactly. After a timely agency protest, a GAO protest is due within 10 days of when you knew or should have known of the initial adverse agency action (4 CFR 21.2(a)(3)). That action includes a denial, but also bid opening, receipt of proposals or an award while your agency protest is still pending (21.0(e)), so if closing passes without an answer, your 10 days have likely started. For a solicitation challenge, the GAO protest can come after closing if it is inside those 10 days.

Appeals inside the agency do not extend that deadline. Agency filings also follow the agency's close of business, presumed to be 4:30 p.m. local time (RFO 33.102), not GAO's 5:30 p.m. Eastern.

An agency protest also has to ask for something. Oready emailed the contracting officers copies of its GAO protests, then argued those were agency-level protests. GAO disagreed, because the emails sought no ruling or relief from the agency. That decision applies the old FAR 33.103; RFO 33.104-4 likewise requires a request for a ruling and the relief sought. Our FAR overhaul explainer covers the wider rewrite.

Time spent at the agency first does not count toward GAO's costs test. VESEQU, LLC, a service-disabled veteran-owned firm, protested to the VA a day after rejection, lost, then went to GAO. The VA announced corrective action on July 22, five days before its report was due, and GAO recommended no costs: it generally treats corrective action by the report date as prompt, and called the earlier agency protest "of no consequence" (B-424606.3, Sept. 17, 2026). For the veteran programs themselves, see contracting for veterans.

Will a protest stop the winner from starting work?

Sometimes, on a tighter clock than GAO's filing deadline. The stay comes from 31 U.S.C. 3553, and GAO does not administer it (21.6).

• Before award: once notified by GAO, the agency may not award while the protest is pending, absent a written urgent-and-compelling finding.
• After award: performance is suspended only if the agency gets notice within the later of 10 days after award or 5 days after the offered date of a requested and required debriefing. For Defense buys, the 5 days start when written answers to your debriefing questions are delivered. A written override is possible.

The stay turns on when the agency receives GAO's notice, and GAO has up to 1 day to send it (21.3(a)), so filing on the last day of the window may be too late. A protest filed 6 to 10 days after a required debriefing can be timely at GAO yet get no stay.

In ATP Gov, LLC, GAO's FY2025 report explains that, according to the Air Force, because the protester "did not file its protest within five days of receiving a debriefing," there was no automatic stay, and the awardee kept performing. An agency protest does not extend the stay window either (RFO 33.104-4(b)(2)).

What can't GAO decide?

• Size and NAICS. These "may be reviewed solely by the SBA" (21.5(b)). A size protest must reach the contracting officer by close of business on the 5th business day after bid opening in a sealed-bid buy, or after the contracting officer tells you who the prospective awardee is in a negotiated one (13 CFR 121.1004); our guide on calculating SBA size shows the math. Status challenges run through SBA's own rules, as our HUBZone page shows for that program.
• Contract administration, such as disputes over how an awarded contract is performed, which belong under the Contract Disputes Act.
• Most task and delivery orders. Civilian orders can be protested only if they increase the contract's scope, period or maximum value, or exceed $10 million (41 U.S.C. 4106(f)). For Defense the line is $35 million, raised from $25 million by the FY2025 NDAA (10 U.S.C. 3406(f)).
• Others, including subcontract protests, suspensions, debarments and most 8(a) placement decisions.

What do recent decisions say about the evaluation itself?

• Answer every requirement by name. H2L Solutions, an SDVOSB, lost a VA media sanitization order set aside for SDVOSBs on the Federal Supply Schedule. PWS 5.2.3 covered tape media, which its quote did not specifically address, and GAO said marking it down was not an unstated criterion (B-424610, Sept. 14, 2026). See our page on schedule ordering rules.
• Your references are not the whole file. A NAVFAC solicitation let the Navy search CPARS by CAGE and UEI, and it found Marginal ratings beyond the submitted projects; GAO found that reasonable (B-424537 et al., Sept. 4, 2026). More in our guide to past performance for new contractors.

What happens after I file, and what are the odds?

The agency report is due 30 days after GAO's notice, and your comments 10 days after that. Miss the comment deadline and the protest is dismissed; ignore the report's answer to an argument and that argument is dismissed (21.3). A party can ask GAO within 5 days of filing to use a 65-day express option, and GAO decides whether the case is suitable (21.10).

If GAO sustains, it may recommend recompeting, resoliciting, terminating or a new award, plus your protest and proposal costs. These are recommendations; in ATP Gov the Air Force declined to reevaluate or resolicit, citing substantial costs and delays. After corrective action you have 15 days from learning GAO closed the case to ask for costs, and a certified claim to the agency is due within 60 days of a costs recommendation (21.8).

GAO's FY2025 report (Dec. 12, 2025) counted 1,617 protests, 380 merit decisions and 53 sustains, a 14% sustain rate. Its 52% effectiveness rate is the share of closed protests where the protester got some relief, including voluntary corrective action. Neither rate is your chance of winning.

Key facts

• Deadline: 10 calendar days from when you knew or should have known; solicitation terms before closing; 10 days after a required debriefing (4 CFR 21.2).
• Cutoff: 5:30 p.m. Eastern in EPDS; 4:30 p.m. local presumed for agency protests.
• Fee: $500 per new protest since October 1, 2024.
• Stay: agency notice from GAO within 10 days of award or 5 days after the offered date of a requested and required debriefing, whichever is later (31 U.S.C. 3553(d)); agencies can override.

This page summarizes 4 CFR part 21, GAO's EPDS Instructions (September 2024), bid protest FAQ and FY2025 annual report, 31 U.S.C. 3553, 41 U.S.C. 4106, 10 U.S.C. 3406, 13 CFR 121.1004, the RFO Part 12, 15 and 33 model text and the GAO decisions named above, as of September 28, 2026. Confirm filing details on gao.gov and read the full decisions before relying on them.

Independent information, not legal advice. ZeroGov is not GAO, not SAM.gov and not the U.S. government.