CMMC and AI with CUI - what the rules actually say

If you use a large language model, an ML pipeline or an AI coding assistant on a defense contract, the question is whether controlled unclassified information (CUI) touches it. The CMMC rule does not answer in AI terms. It answers in system terms. For live program names and § 170.19 asset categories, see CMMC Program scoping for generative systems that handle CUI.

CMMC has no AI-specific requirements

We searched the text of 32 CFR Part 170 and the NIST SP 800-171 Rev. 3 PDF for “artificial intelligence” and “machine learning” and found no matches. That is a search of the versions available on 14 October 2026, not a legal opinion. What the rules do say is about scope: NIST SP 800-171 applies to components of nonfederal systems that process, store, or transmit CUI, or that provide protection for such components.

Step 1: is CUI in the AI system’s path?

DFARS 252.204-7021 requires a CMMC status for all information systems used in performance of the contract that process, store, or transmit FCI or CUI. Analysis: for an AI system, ask where CUI could enter. Prompts and uploaded documents, retrieval indexes, fine-tuning or training data, logs and chat history, and model outputs that reproduce CUI are all places data can be processed, stored or transmitted. If any is in scope, the component is in scope.

Step 2: who operates the AI service?

• A cloud AI service operated by a third party. For CMMC Level 2, an organization may use a cloud environment for CUI only if the offering is FedRAMP Authorized at the Moderate (or higher) baseline, or meets security requirements equivalent to it. DoD’s equivalency guidance says offerings must achieve 100% compliance with the latest FedRAMP Moderate baseline as assessed by a FedRAMP-recognized third-party assessor. Analysis: general vendor security claims do not by themselves meet this test.
• A service provider that is not a cloud provider (for example a managed AI operations contractor). Its services are in the organization’s assessment scope and assessed as part of it.
• An AI system you run yourself. It is part of your own system boundary and is assessed against the same requirements as other components.

The same scoping rule also says the organization’s on-premises infrastructure connecting to the service is in the assessment scope, and that the customer responsibility matrix (CRM) must be documented in the system security plan.

Step 3: keep the requirements version straight

The CMMC rule incorporates NIST SP 800-171 Revision 2, while NIST has since published Revision 3, superseding Rev. 2. DoD says it is enforcing Rev 2 during the current suspension.

Where CMMC stands (re-verified 14 October 2026)

DoD CIO says that on July 13, 2026 the Department announced the immediate suspension of CMMC Phase II, originally scheduled for November 10, 2026, while Phase I self-assessment requirements remain in place and implementation is paused in Phase 1. During the suspension the Department will enforce cybersecurity compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments. The same page says the Department will begin a comprehensive review of CMMC aimed at aligning with the Secretary of War Pete Hegseth’s Acquisition Transformation System (ATS) directives. An implementing memo says requiring activities may only designate CMMC Level 1 (Self) or Level 2 (Self) during the suspension. The suspension does not eliminate the requirement to protect information under DFARS clause 252.204-7012. Check DoD CIO for any announcement of the program review’s outcome.

What this article does not say

We do not say any named AI product is or is not acceptable for CUI. That depends on the product’s FedRAMP status or equivalence evidence, your contract, and your system security plan. This is general information, not legal advice. See the CMMC reference page, CMMC Level 2 vs Level 3 for AI systems, which 800-171 controls official pages actually discuss for AI tools that handle CUI, the audit evidence checklist, and the printable CMMC + AI checklist.