Can defense contractors use commercial AI tools with CUI?

Only where the service meets the requirements that attach to any cloud service handling covered defense information. The safeguarding clause requires that a cloud service provider storing, processing or transmitting such information meet security requirements equivalent to the FedRAMP Moderate baseline, and that the contractor comply with the incident reporting, malicious software submission, media preservation and access provisions. A consumer AI product with no government-community offering and no equivalency documentation does not satisfy that, regardless of how good its enterprise privacy terms are. The government-cloud tiers that AI vendors now offer exist precisely because of this clause.

Is pasting CUI into a chatbot a reportable cyber incident?

Treat it as one until analysis says otherwise. The reporting trigger is an event that results in an actual or potentially adverse effect on covered defense information residing on or transiting a contractor system, and the report is due rapidly — within 72 hours of discovery. Sending covered information to an unapproved external service is a loss of the safeguarding boundary, which fits. Contractors often hesitate because the destination is a reputable vendor rather than an attacker, but the clause is written around where the information went, not around who received it or whether they meant well.

Does an enterprise no-training agreement solve the problem?

It addresses one risk and leaves the compliance question open. A no-training commitment limits secondary use; it says nothing about whether the service meets the required baseline, where the data is stored, whether personnel supporting the service are US persons where that matters, whether the provider will preserve media and submit malicious software on request, or whether they will support your reporting obligation on your timeline. Those are the terms the clause actually requires. A vendor that will sign a no-training addendum but not an incident-cooperation commitment has solved your privacy concern and not your contractual one.

How does AI use surface during a CMMC assessment?

Through scope, not through a question about AI. An assessor establishes the boundary by examining asset inventories, network diagrams, data flows and outbound connections, then tests controls against that boundary. Undeclared AI tooling shows up as unexplained egress, as browser extensions on assessed endpoints, as an integration in a collaboration platform, or in the plain fact that staff describe a workflow that requires a tool nobody listed. A boundary that omits a system where covered information demonstrably travels is a scoping failure, which is more damaging than a control gap because it undermines the reliability of everything else in the assessment.

Do these obligations flow down to subcontractors?

Yes, and this is where most primes are exposed. The safeguarding clause is required to be included in subcontracts where the subcontractor will handle covered defense information, and reporting obligations run through the chain. A small supplier under schedule pressure is the likeliest place a commercial AI tool is quietly doing the work, and the prime learns about it during an incident. Flowdown language alone does not manage that risk. An affirmative attestation about AI tooling and covered information, requested at award and refreshed annually, is what turns the clause into something you can rely on.

What about AI features switched on inside tools we already approved?

This is the fastest-moving version of the problem. Assistants and summarisation features are being enabled by default inside document platforms, ticketing systems, meeting tools and code repositories that already sit inside an assessed boundary. Enabling one can route content to a processing location or subprocessor that was never part of the authorised configuration, without any new procurement and without anyone deciding anything. Configuration baselines should name AI features explicitly as items requiring approval, and change monitoring should treat a vendor-enabled feature as a change even though nobody in your organisation made it.

An Engineer Pasted a Drawing Into a Chatbot.

Five Obligations, and Where AI Hits Each

None of these obligations were drafted with language models in mind, which is exactly why they apply cleanly. Each states a requirement about information and systems, and AI tooling is simply another system once covered content reaches it.

Adequate security on covered systems

Implement the NIST protection requirements for controlled unclassified information on every system that stores, processes or transmits it.

An AI tool used on covered content becomes such a system. It then inherits access control, audit, media protection and configuration management requirements that a consumer subscription cannot evidence.

Cloud service equivalency

External cloud services handling covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline.

This is the clause that decides which AI offering you may use at all. Commercial tiers of major AI products generally do not carry it; government-community tiers exist for this reason and are a different contract, not a settings change.

Rapid incident reporting

Report cyber incidents affecting covered defense information within 72 hours of discovery, with media preservation and malicious software submission obligations attached.

Discovery is often a support ticket or a colleague's remark. The clock starts then, not when legal finishes deliberating whether a helpful vendor counts as an incident.

Flowdown to subcontractors

Include the safeguarding requirements in subcontracts where the subcontractor will handle covered defense information.

Small suppliers under deadline are where unapproved AI use concentrates, and the prime carries the consequence. Flowdown text without an affirmative attestation is a paperwork control.

Accurate assessment scoping

The assessment boundary must reflect where covered information actually lives and moves.

Undeclared AI tooling makes the boundary wrong. A scoping failure calls the entire assessment into question in a way that a single failed control does not.

The 72-Hour Clock Starts at Discovery

The most expensive mistake in this area is not the paste. It is the week spent deciding whether the paste counted. Reporting is triggered by an event with an actual or potentially adverse effect on covered information, and the obligation is deliberately fast — measured from discovery, which usually means the moment a colleague mentioned it, not the moment counsel reached a conclusion.

Deliberation feels prudent because the facts are unfamiliar: there is no intruder, no ransom note, no obvious harm. But the clause contemplates potential adverse effect precisely so that the contractor does not get to resolve that ambiguity in its own favour. Decide the policy now, while nothing has happened — write down that covered information reaching an unapproved external service is handled as a reportable event by default, with analysis running in parallel rather than in front.

Where the Assessor Finds It

Assessors do not ask whether you use AI. They establish the boundary from inventories, diagrams and data flows, then test against it — and undeclared tooling surfaces as a contradiction between what the documentation says and what the environment does. Every item below has been the thing that did not match.

What contradicts the boundary

▸Outbound network traffic from assessed endpoints to AI service domains that appear on no inventory.
▸Browser extensions and desktop assistants installed by individuals on machines inside the boundary.
▸AI features enabled by the vendor inside already-approved collaboration, ticketing and code platforms.
▸Code assistants indexing repositories that contain export-controlled or covered technical data.
▸Meeting transcription running on programme calls, producing a transcript store nobody classified.
▸Proposal and capture teams drafting against source documents that carry markings.

The third item deserves separate attention because nobody in your organisation causes it. Assistants and summarisation features are switched on by vendors inside platforms that already sit within an assessed boundary, routing content to processing that was never part of the authorised configuration. Treat a vendor-enabled AI feature as a configuration change subject to approval, even though the change did not originate with you — otherwise your baseline drifts on someone else's release schedule.

Flowdown Is Not a Control

Primes include the required clause in subcontracts and treat the obligation as discharged. It is not, because the risk concentrates exactly where the paperwork is weakest: a small supplier, under schedule pressure, with no security staff and a very helpful tool. The version of this that works is an affirmative attestation — a specific question about which AI services touch covered information, answered at award and refreshed annually, with a named individual behind the answer. It costs one email and converts an unknown into a documented representation you can act on.

What To Have In Place

An inventory of AI services in use, including features inside platforms you already approved. A written rule stating which tier of which service may touch covered information, with the equivalency documentation on file for anything approved. Blocking or monitoring for unapproved services on assessed endpoints, because a policy nobody can enforce is not evidence. Contract terms with any approved provider covering incident cooperation, media preservation and location of processing — not only training and retention. And a standing decision that unapproved destinations are treated as reportable, so the 72-hour clock is never spent debating.

Your Capability Pages Are Read During Source Selection

Compliance statements, certification badges and AI capability claims on your public site are checked by contracting officers and by competitors filing protests — and they age badly when a claim outlives the assessment behind it.

See every claim your site currently makes. Run a free scan and check each against your actual posture.

This article is general information and not legal advice. Contract clauses, assessment requirements and marking obligations vary by contract, agency and programme, and the applicable requirements are those in your award. Consult qualified government-contracts counsel and your assessment organisation before relying on any conclusion here.