AI Governance in a CMMC / CUI Environment

What the Heck Does AI Governance Look Like in a CMMC Environment? ...Your Smartest New Hire Can't Keep a Secret

Yes, defense contractors can use AI ...or should we say SI? No, you cannot paste CUI into whatever chatbot your employee found last Tuesday. The moment Controlled Unclassified Information touches an AI tool, that tool is in your CMMC scope, and it has to meet the same requirements as every other system that stores, processes, or transmits CUI.

Now for the fun part.

Picture the new hire everyone loves. Read every textbook ever written. Drafts a proposal faster than anyone in the building. Never asks for PTO. Also remembers everything you tell him, works for a company you've never vetted, and lives on servers you can't point to on a map. That's commercial AI in a CUI environment. Brilliant help. Terrible secret keeper. Unless you govern it.

Where Most Defense Contractors are Right Now

1. Your people are already using AI. Engineers summarize specs with it. Somebody's browser extension is "helpfully" summarizing every page they open. If you haven't approved any AI tools, that doesn't mean nobody uses them. It means nobody told you.
2. Congress made it official. Section 1513 of the FY2026 NDAA directs DoD to build a security framework for AI and machine learning as an extension of existing DoD cybersecurity frameworks, naming CMMC directly, and to write the requirements into DFARS. DoD owed Congress a status update on its implementation timeline by June 16, 2026. As of this writing, we have not seen a published framework contractors can implement. It's coming, and it's built on the same NIST 800-series foundation your Level 2 program already sits on.
3. Some AI is now flat-out off limits. Section 1532 of the FY2026 NDAA prohibits contractors from using "covered artificial intelligence," which includes AI from DeepSeek and High Flyer, in the performance of DoD contracts unless a waiver applies. That's not a best practice. That's a statute.

Your obligations under DFARS 252.204-7012, your NIST SP 800-171 implementation, and your SPRS score all apply.

Where AI Applies to Your CMMC Controls

AI is not a brand-new compliance category. To CMMC, an AI tool is just another external system or cloud service. Which means the controls you already know apply to it. Every reference below is NIST SP 800-171 Rev 2, the current basis for CMMC Level 2 under 32 C.F.R. Part 170.

Asset inventory (3.4.1). If an AI tool stores, processes, or transmits CUI, it's a CUI asset. It belongs in your inventory and your System Security Plan (3.12.4), categorized under the scoping rules in 32 C.F.R. 170.19.

External connections (3.1.20). A chatbot in a browser tab is an external system. You're required to verify and control connections to it. "Our people just go to the website" is not control.

CUI flow (3.1.3). You must control where CUI goes. If your CUI flow diagram doesn't show an arrow to an AI service, then CUI going there is, by definition, an uncontrolled flow.

Cloud requirements (DFARS 252.204-7012(b)(2)(ii)(D)). If a cloud service stores, processes, or transmits CUI, it must meet FedRAMP Moderate baseline or equivalent. The DoD CIO memo of December 21, 2023 spells out what "equivalent" means, and it is not a vendor's marketing page. The consumer or standard commercial tier of most AI tools will not meet this. You have to verify the specific service, the specific tier, and the specific configuration.

Software control (3.4.8 and 3.4.9). Desktop AI apps and AI browser extensions are user-installed software. Your allow-listing and user-installed software controls apply.

Boundary protection (3.13.1 and 3.13.6). Deny by default, permit by exception. Unapproved AI domains should be blocked on in-scope assets, not just discouraged in a policy nobody reads.

Audit logging (3.3.1 and 3.3.2). For any AI tool you do approve inside the boundary, you need to know who used it and be able to trace actions back to that user.

Awareness training (3.2.1 and 3.2.2). Your people need to know what's allowed and what isn't, with examples from their actual jobs.

Risk assessment (3.11.1). AI use belongs in your periodic risk assessment. New tool, new risk, documented decision.

Level 1 folks, you're not off the hook. FAR 52.204-21(b)(1)(iii) (CMMC AC.L1-b.1.iii) requires you to verify and control connections to external information systems for FCI. Same concept, smaller scope.

The Output Problem Less People are Talking About

Everyone focuses on what goes into the AI. Fewer people think about what comes out.

If you feed a CUI specification into an approved AI tool and ask for a test plan, the test plan is CUI. The CUI program (32 C.F.R. Part 2002, implemented at DoD through DoDI 5200.48) doesn't care whether a person or a model wrote the derivative. It has to be marked, stored, and handled like its source.

There isn't detailed DoD guidance yet on marking AI-generated derivatives. That doesn't relieve you of the obligation. It just means you have to apply the rules you already have.

Real-Life Examples Anyone Can Understand

Example 1: The meeting note-taker. An AI note-taking bot auto-joins every call, including your program review with the prime. The transcript, full of technical discussion, lands in a commercial cloud that isn't in your SSP. You now have CUI in an out-of-scope system, and you probably didn't know it until right now.

Example 2: The helpful engineer. An engineer pastes a drawing note and tolerance table into a free chatbot to "clean up the language." Well intentioned. Also an uncontrolled CUI flow to an external system that doesn't meet DFARS 7012 cloud requirements.

Example 3: The right way. A contractor deploys an AI assistant inside its FedRAMP Moderate authorized (or verified equivalent) CUI environment, documents it in the SSP and asset inventory, restricts access by role, logs usage, and trains staff on what goes where. That's not a finding. That's a mature program.

How to Govern AI Without Banning It

Bans don't work. People just use their phones. Here's what does.

1. Find out what's actually in use. Ask your team, then check web filter logs, OAuth app grants, and installed browser extensions. The gap between those two answers is your shadow AI problem.
2. Draw three lanes. Prohibited: covered AI under Section 1532, and any unapproved tool on CUI. Approved for non-CUI work: vetted commercial tools for marketing, general research, and other work that never touches CUI or FCI. Approved for CUI: specific AI services, tiers, and configurations verified to sit inside your compliant boundary.
3. Run every AI use case through change management. A new AI tool, a new feature, or a new connector to your file shares is a change to your system. Treat it that way. Before anything gets turned on, someone submits a use case and it gets a security impact analysis (3.4.4). The review should answer, in writing:
   • What business problem is this solving, and who will use it?
   • What data will it touch: CUI, FCI, export-controlled, or none?
   • Which exact service, tier, and configuration? Is it FedRAMP Moderate authorized or equivalent, and where's the proof?
   • What does the vendor do with prompts and outputs? Retention, training on your data, data location, and who can access support data. If you handle ITAR technical data, foreign-person access raises its own separate set of questions.
   • What integrations does it need (mailboxes, SharePoint, Teams, file shares), and what access will those grant?
   • Where do outputs get stored, and how will derivative CUI be marked?
   • Does it change your CUI boundary, data flows, or baseline configuration?
4. Write an AI acceptable use policy. Tie it to your existing acceptable use and CUI handling policies. Name the approved tools. Use plain language.
5. Enforce it technically. Block unapproved AI domains and extensions on in-scope assets (3.13.6, 3.4.8, 3.4.9). Use conditional access to keep CUI-capable accounts away from non-approved tools.
6. Document it. Update your SSP, asset inventory, and CUI flow diagram. If your answer is "we don't use AI with CUI," document that too, along with how you enforce it.
7. Read the vendor fine print. Data retention, training on your inputs, data location, and who can access support data. If you handle ITAR technical data, foreign-person access raises its own separate set of questions.
8. Keep an eye on Section 1513. When the DoD framework lands, contractors with an AI inventory and governance policy already in place will be adjusting. Everyone else will be starting.

When AI Governance Goes Wrong: The "What Were They Thinking?" Files

• The AI policy that says "use good judgment." (About as effective as a "please don't take my car" sign on an unlocked Corvette.)
• The company that "banned AI" while half the shop floor uses it on their phones. (See also: Prohibition. That went great.)
• Using DeepSeek because it was free and fast. (Free like a puppy. Except this puppy comes with a federal statute.)
• The note-taking bot that has attended more program reviews than your program manager.

What Your Assessor Is Going to Ask

Speaking as people who sit on both sides of the table, here's what to expect when AI comes up:

• "Where are AI tools in your asset inventory?"
• "How do you prevent CUI from being entered into unapproved AI services?"
• "Show me the technical control, not just the policy."
• "Show me the training records."

And if you say "we don't use AI," the next sentence will be some version of "show me how you know that." Be ready.

Bottom Line. Treat AI Like Every Other System That Touches CUI

AI governance in a CMMC environment isn't exotic. It's inventory, boundary, flow control, cloud requirements, training, and evidence. The same fundamentals you're already working on, applied to the newest and most popular tool in the building.

The contractors who get this right won't be the ones who said no to AI. They'll be the ones who can show an assessor, a prime, or a contracting officer exactly where AI lives in their environment and exactly why CUI is safe. Your smartest new hire can stay. He just needs a badge, a clearance check, and a very clear set of rules.

‍