The law on this is very confusing and companies are often surprised to learn they may be federal contractors. (41 CFR 60-1.40) Further, there may be disagreement between the OFCCP and a company on whether a company is in fact a federal contractor. There has been significant litigation with respect to jurisdiction (the requirement to have an AAP). It is not as clear cut as one might expect. The rules on whether a company needs an AAP are vaguely defined since "subcontracts" and "contract" are not defined in the regulations. There is nothing that requires the funding be guaranteed, only that the value of the contract meet the threshold. The DD 254 Further muddies the waters for your company. It becomes a question of risk. If the OFCCP says that is has jurisdiction, the company should be prepared to respond. Note that section 60-3.10 does require the company with which you provide employees to analyze data, regardless of your company's contractor status.
You can use this OFCCP audit checklist to ensure you're doing what is required to maintain OFCCP's regulations including VEVRAA, Section 503, and EO 11246. Or request a demo to streamline your compliance and recruiting efforts.