CMMC Level 2 vs Level 3 for AI systems

CMMC does not have an “AI level.” It has information-system levels. If an AI system processes, stores or transmits CUI, it is in the assessment scope at whatever CMMC status the contract specifies. This page compares Level 2 and Level 3 using the rule text. For how CUI enters an AI path, see CMMC and AI with CUI.

What each level is built from

32 CFR 170.14 says CMMC Levels 1–3 use 48 CFR 52.204-21 for Level 1, NIST SP 800-171 R2 for Level 2, and selected requirements from NIST SP 800-172 February 2021 for Level 3.

The same section is explicit:

• Level 2 security requirements are identical to the requirements in NIST SP 800-171 R2.
• Level 3 security requirements are selected from NIST SP 800-172 Feb2021, with DoD-assigned organization-defined parameters where the table in that section applies.

NIST describes SP 800-172 as enhanced security requirements that supplement SP 800-171. It is not a replacement for 800-171, and it is not an AI-assurance method.

The CMMC Program overview in 32 CFR Part 170 describes this as 15 Level 1 requirements, 110 Level 2 requirements from NIST SP 800-171 R2, and 24 Level 3 requirements from NIST SP 800-172.

Who assesses what

§ 170.17 says an organization seeking certification must obtain a Level 2 certification assessment from an authorized or accredited C3PAO. Achieving Level 2 (C3PAO) also satisfies Level 1 (Self) and Level 2 (Self) for the same scope.

§ 170.18 is the Level 3 certification section. The rule text for Level 3 is a DoD-conducted assessment after Final Level 2 (C3PAO).

What this means for an AI system

We searched 32 CFR Part 170 and NIST SP 800-171 Rev. 3 for “artificial intelligence” and “machine learning” and found no matches as of 14 October 2026. The scoping question is the same at both levels: does the AI component process, store or transmit CUI, or protect a component that does?

If a third-party cloud model is in that path, Level 2 still requires the FedRAMP Moderate authorization or DoD-recognized equivalency discussed in the CMMC and AI with CUI article. Level 3 does not replace that cloud rule; it adds selected 800-172 requirements on top of a certified Level 2 scope.

Analysis, not sourced fact: prompts, retrieval indexes, fine-tuning sets, logs and model outputs that can reproduce CUI are the usual places an AI system crosses the Level 2 or Level 3 boundary. The level itself is chosen in the contract, not by the model architecture.

Phase 2 is suspended

DoD CIO says Phase II was suspended on 13 July 2026, that implementation is paused in Phase 1, and that Phase I self-assessment requirements remain. The implementing memo says requiring activities may only designate CMMC Level 1 (Self) or Level 2 (Self) during the suspension. Status as of 14 October 2026: those Phase II suspension sentences still match the About page we re-fetched; the About host is often HTTP 403 on the automated checker. Check DoD CIO before treating a Level 3 designation as current policy.

Questions

Does an LLM automatically need Level 3?

No source we cite says that. Level 3 is selected 800-172 requirements after Final Level 2 (C3PAO), assigned by the contracting officer, not by the presence of a generative model.

Is Level 2 enough if the model never sees CUI?

If the system does not process, store or transmit FCI or CUI, it is outside the CMMC assessment scope those sections describe. That is a scoping conclusion you have to document, not a model-card claim.

Where do I read the 24 Level 3 requirements?

Table 1 in 32 CFR 170.14(c)(4) lists the selected NIST SP 800-172 February 2021 requirements and the DoD-assigned parameters. NIST’s 800-172 page is the underlying supplement.

See the CMMC / NIST SP 800-171 explainer, the audit evidence checklist, and the printable CMMC + AI checklist.