Supplier flow-down clauses for SI/AI in defense contracts

Defense programs that use machine-learning components still inherit information-safeguarding flow-down, not an AI-titled clause. We searched the live DFARS Part 252 text on Acquisition.gov for the phrases “artificial intelligence,” “machine learning,” and “Super Intelligence” and found no clause whose title or body uses those phrases. Official pages still say CMMC, CUI, FCI, NIST SP 800-171, Artificial Intelligence and AI where those documents use them. Super Intelligence (SI) is this site’s own-voice term for current U.S. executive-branch policy; it does not rewrite DFARS or FAR clause titles.

Executive Order 14434 Section 2(b) states, in those words, Nothing in this section requires the alteration of previously issued regulations, Presidential actions, contracts, grants, or other historical documents. The clauses below sit in that class. Completing the CDAO AIA / RAI Toolkit is a voluntary process; the 2023 announcement does not make it a flow-down clause.

For how CMMC talks about systems that handle CUI, see CMMC and AI with CUI and CMMC Program scoping. For a UK supplier read, see JSP 936 Part 1.

What 252.204-7012 actually flows down

DFARS 252.204-7012 is titled Safeguarding Covered Defense Information and Cyber Incident Reporting (MAY 2024). Paragraph (m), Subcontracts, says the Contractor shall Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer.

DoD CIO says the CMMC Phase II suspension does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012.

What 252.204-7020 actually flows down

DFARS 252.204-7020 is titled NIST SP 800-171 DoD Assessment Requirements (NOV 2023). Paragraph (g), Subcontracts, says the Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services (excluding commercially available off-the-shelf).

The same paragraph says the Contractor shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST SP 800–171 security requirements, in accordance with DFARS clause 252.204–7012 of this contract, unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800–171 DoD Assessment for covered contractor information systems relevant to its offer that are not part of an IT service or system operated on behalf of the Government.

What 252.204-7021 actually flows down

DFARS 252.204-7021 is titled Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (NOV 2025). Paragraph (d)(1)(ii) tells the Contractor to Consult 32 CFR 170.23 related to the flowdown of the CMMC requirements, and flow down the correct CMMC level to subcontracts and other contractual instruments. This article quotes that consult-and-flow-down sentence. It does not reconstruct unpublished paragraph text from 32 CFR 170.23.

Paragraph (f), Subcontracts, says the Contractor shall Insert the substance of this clause, including this paragraph ( f) and excluding paragraph (e)(1), in subcontracts and other contractual instruments, including those for the acquisition of commercial products and commercial services, excluding commercially available off-the-shelf items , if the subcontract or other contractual instrument will contain a requirement to process, store, or transmit FCI or CUI. Before award, the Contractor shall ensure that the subcontractor has a current CMMC certificate or current CMMC status at the CMMC level that is appropriate for the information that is being flowed down to the subcontractor based on the requirements at 32 CFR 170.23.

DoD CIO currently says The CMMC Program is paused in Phase 1 and may only require self-assessments at two levels. Read 7021 next to that live program-status page. Do not treat a paused Phase II as deleting 7012.

What FAR 52.204-21 actually flows down

FAR 52.204-21 is titled Basic Safeguarding of Covered Contractor Information Systems (Nov 2021). Paragraph (c), Subcontracts, says The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

The same clause defines Federal contract information as information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments. Paragraph (b)(2) adds that this clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

How to read the four together

Analysis, not sourced fact: putting a model, a prompt log, or a training set on a subcontractor system does not create an AI DFARS clause. It can still put FCI or CUI / covered defense information on that system, which is what these four paragraphs actually test. Completing the AIA Toolkit does not, on any page we cite, substitute for them.

Questions

Is there a DFARS clause titled Artificial Intelligence or Super Intelligence?

We searched the live Part 252 text for those phrases and did not find a clause titled that way. Absence from a search is not a legal opinion. It is why this article quotes the safeguarding clauses that actually name flow-down.

Does EO 14434 require primes to rewrite those clauses as Super Intelligence?

Section 2(b) says nothing in that section requires the alteration of previously issued regulations, Presidential actions, contracts, grants, or other historical documents.

Does the CMMC Phase II pause end 7012 flow-down?

DoD CIO says the action does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012.