How to Answer the AI Questions in a Prime Contractor's CMMC Questionnaire

When a prime contractor's CMMC questionnaire asks about AI use, it is asking whether controlled unclassified information (CUI) from its program could end up somewhere it should not. For architecture and engineering firms on defense projects, these questions arrive alongside the usual CMMC and NIST SP 800-171 items. This checklist covers what the questions are getting at and which document each answer should come from.

Why do prime contractors ask about AI?

The prime is responsible for flowing cybersecurity requirements down to its subcontractors, and an AI tool is another place CUI can end up. A prime that cannot show it checked is carrying your risk on its own contract.

DFARS 252.204-7012 requires the prime to include the clause in subcontracts whose performance involves covered defense information, and requires subcontractors to report cyber incidents to DoD and give the prime the incident report number. 32 CFR 170.23 applies CMMC requirements to subcontractors that process, store or transmit FCI or CUI, and DFARS 252.204-7021 requires the prime to confirm a subcontractor's current CMMC status before award. For more on that process, see how primes check subcontractors.

Do these questions still matter while CMMC Phase 2 is suspended?

Yes. The Department of War suspended CMMC Phase 2 on July 13, 2026, which paused Level 2 C3PAO certification as a condition of award. DFARS 252.204-7012, the NIST SP 800-171 requirements, Level 1 and Level 2 self-assessments, SPRS scores and annual affirmations all still apply, and each of them reaches any AI tool that touches CUI. As of late October 2026, the department had not announced a restart date. What still applies after the suspension covers the details.

What will a CMMC questionnaire ask about AI, and where does each answer come from?

Most AI questions fall into five groups. Each maps to a requirement you already carry, so each answer should come from a document you already keep.

Which AI tools do you use?

Answer from your inventory of approved software and services, including AI features inside tools you already license, such as design software add-ons and assistants built into office software. If you do not have an inventory, build it before answering. Answers based on guesses are hard to defend later.

Can any AI tool access CUI?

Answer from your system security plan. NIST SP 800-171 requirement 3.12.4 requires a system security plan that describes the system boundary, and requirement 3.1.3 requires controlling the flow of CUI. If an AI tool sits outside the boundary, say so and describe how CUI is kept out of it. If it sits inside, it has to meet the same requirements as the rest of the system.

Does the AI service meet FedRAMP Moderate?

Answer from the vendor's authorization or equivalency documentation. DFARS 252.204-7012(b)(2)(ii)(D) requires any external cloud service that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline. DoD's December 2023 memo sets out what equivalency means. For AI tools with a FedRAMP authorization, check the FedRAMP Marketplace listing for the exact service and edition your staff use, since consumer and government editions of the same product are often authorized differently. If a vendor cannot produce FedRAMP Moderate authorization or equivalency documentation, the accurate answer is that CUI is not permitted in that tool.

How do you stop staff from using unapproved AI tools?

Answer with technical controls first, then policy. NIST SP 800-171 requirement 3.1.22 requires controlling CUI posted or processed on publicly accessible systems, and requirement 3.2.1 requires making users aware of security risks. Describe web filtering that blocks unapproved AI sites, data loss prevention rules for CUI markings, and the training staff complete. A policy on its own is a weak answer when the prime asks how it is enforced.

How would you report an AI-related incident?

Answer from your incident response plan. DFARS 252.204-7012 requires reporting cyber incidents affecting covered defense information to DoD within 72 hours of discovery. If CUI is pasted into an unapproved AI tool, your plan should treat it as a potential incident. See how to report a CUI spill into an AI tool.

How should you answer if you are not fully there yet?

Answer accurately and show the plan. Cybersecurity representations made in connection with federal contracts can carry False Claims Act exposure, so an accurate answer with a dated plan is worth more than an optimistic one.

• If a control is not in place, say so and give the planned completion date.
• Point to your plan of action and milestones for open NIST SP 800-171 gaps instead of describing them as met.
• Keep a copy of every answer, the date sent, and the documents it relied on.
• Route answers past the person who signs your annual affirmation so they match what you have affirmed in SPRS.

What should you do this quarter, before the next questionnaire arrives?

• Build an AI inventory that covers standalone tools and AI features in licensed software. Finding AI plugins on design workstations is a good place to start.
• Mark each tool as approved for CUI, approved without CUI, or blocked, and record the decision in your system security plan.
• Write one standard answer set for AI questions that compliance staff and project leads both use.
• Confirm your SPRS score and annual affirmation are current.
• Run a short drill: CUI pasted into a public AI tool, from discovery to the 72-hour reporting decision.

How can s90 help you answer AI questions from a prime?

s90 sets up data loss prevention and zero trust network access so CUI stays inside approved systems, and we keep your AI tool inventory and system security plan in step so questionnaire answers match your controls. When a prime's questionnaire arrives, we help your team pull the evidence behind each answer. If one is sitting in your inbox now, talk to our team.