Defense contractors can use AI, but the moment CUI touches an AI tool, that tool enters CMMC scope and must meet NIST SP 800-171 and DFARS 252.204-7012 requirements like any other system. This post explains why AI governance is urgent now (shadow AI, FY2026 NDAA Section 1513's coming AI security framework, and Section 1532's ban on covered AI such as DeepSeek), maps AI use to specific NIST SP 800-171 controls, addresses the often-missed problem of AI-generated derivative CUI, explains why security fundamentals like access control and CUI identification must be in place before AI adoption, and lays out eight practical steps to govern AI without banning it, including change management, use case security impact reviews, and an approved AI register, plus what assessors will ask.
A persistent myth across the Defense Industrial Base holds that sole-source subcontractors are exempt from CMMC. They are not. In November 2026, certification becomes a condition of eligibility for new awards and continued performance on existing contracts, with no exemptions for sole-source position. This post explains where the myth originates, why a sole-source position raises exposure rather than removing it, and the two converging pressures (a closing assessor-capacity window and the SPRS eligibility gate) that put unprepared firms at risk. It closes with four structured actions: confirm scope, validate the SPRS record, audit the supply chain, and secure assessment capacity early.
