AI Compliance for Government Contracting: CMMC + AI in 2026
Check the contract, information category, system boundary and cloud evidence before using AI with government information. A worksheet helps organize the review.
Start with the applicable solicitation or contract, information category and system boundary. CMMC Level 2 can involve different assessment types. Trace AI processing, storage, logs and subcontractors, then evaluate the exact service and evidence. Removing a marking does not decontrol CUI, and a vendor name does not establish compliance.
An AI service is part of a contractor's data path when it processes, stores or transmits contract information. Start with the actual contract, information category and system boundary. A vendor's product name does not establish that your use is acceptable.
Read the contract requirement first
DFARS 252.204-7021 distinguishes Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC). The required level and assessment type come from the applicable solicitation or contract. Do not assume every CUI engagement requires the same assessment, or that bidding, award and performance have interchangeable requirements.
Record the clause version, required status, relevant system identifiers, affirmation obligations and subcontract flowdowns. Check current program policy as well as the contract. A general article's rollout calendar is not a substitute for those documents. The analysis here uses the contract clauses checked on October 14, 2026 and does not promise a particular assessment schedule.
Trace where the information goes
Build one inventory row for each proposed AI use. Include the information owner and category, source system, AI service, retrieval store, log destination, support access, retention settings and person responsible for approving the use.
Follow the entire route: upload, retrieval, model request, output, cache, logs, backups and export. A tool that does not train on prompts can still process or store the information. A local model can still send telemetry or use an external connector. Include those dependencies in the review.
Removing a marking does not decontrol CUI
Deleting a CUI banner or a customer name does not establish that the remaining information is unrestricted. National Archives decontrol guidance describes decontrol as a distinct authorized action. It also says decontrol itself is not authorization for public release.
Use public or synthetic material for an initial demonstration. If a workflow proposes sanitizing controlled information, have the authorized information owner determine what can be released and document the basis. Do not let an AI model decide that its own redaction removed every control.
Evaluate the specific cloud offering
DFARS 252.204-7012 includes requirements for an external cloud provider handling covered defense information, including FedRAMP Moderate-equivalent security and specified incident-related obligations. Other contract requirements can also apply.
An authorization for one cloud offering, region or service does not cover every product a vendor sells. Ask which exact offering and deployment boundary the evidence covers, which AI features are included, what subcontractors handle the data and what obligations the provider accepts. A government-branded product or an enterprise subscription alone is not an answer.
Self-hosting is another architecture to evaluate, not an automatic compliance result. Access, configuration, monitoring, incident response and assessment evidence still need owners and implementation.
A review worksheet for an AI summarizer
Illustrative proposal: summarize maintenance reports for a defense program. No real contract or controlled records are used in this example.
| Question | Evidence to obtain | Decision still needed |
|---|---|---|
| What is in the reports? | Contract requirements and owner classification | Whether FCI, CUI or other restrictions apply |
| Where are prompts processed? | Exact service, region and architecture | Whether that path fits the approved boundary |
| What else receives the data? | Logging, support, retrieval and backup configuration | Which dependencies need assessment |
| What supports cloud acceptability? | Offering-specific authorization or equivalency evidence and terms | Whether it satisfies the applicable requirements |
| Who reviews a summary? | Named role and source-comparison procedure | What can be used operationally |
A successful demonstration with fictional reports resolves none of the contract questions by itself. Keep the prototype separate from an approved production decision.
Assemble evidence before enabling the workflow
Keep a data-flow diagram, system inventory, access roles, configuration records, provider evidence, incident process and approval decision. Map the implementation to the applicable assessment requirements with a qualified adviser or assessor. Record unresolved items instead of describing the service as “CMMC compatible.”
Review the decision when the service, contract, data category or system boundary changes. Ask the contracting activity about contract ambiguities. An assessor or qualified counsel can help evaluate the facts, but a checklist cannot issue a certification.
For workflow design after the data boundary is understood, compare the multi-agent handoff example. Use the after-action review template to track evidence and corrective actions during a permitted pilot.
Get the next one.
Field notes from real deployments, written the way this one was. No schedule promised and nothing sold to you. Unsubscribe whenever.
Frequently asked questions
Does every CUI contract require the same Level 2 assessment?
No. DFARS 252.204-7021 distinguishes Level 2 (Self) and Level 2 (C3PAO), among other statuses. Read the specific solicitation, contract, applicable rules and current program policy rather than assuming one assessment applies to every engagement.
Can I remove CUI markings before sending a document to AI?
Removing a marking does not establish that the information is no longer controlled. Decontrol and public release are distinct decisions. Obtain the authorized information owner’s determination and document the basis before using the material outside the approved boundary.
Does a government cloud product automatically make AI acceptable?
No. Evaluate the exact offering, deployment boundary, included features, dependencies, provider evidence and contract obligations. An authorization for another service or region does not automatically cover the proposed AI use.
Does self-hosting remove the assessment requirements?
No. A local deployment changes the data path but still needs appropriate access, configuration, monitoring, incident response and evidence for the applicable requirements.
Related guides
Need help implementing this?
Prometheus does AI consulting and implementation, remote, with onsite days available in Milwaukee. We set it up, train your team, and make sure it works.
let's talk