How to Keep CUI Out of AI Tools on Defense Projects

A project architect pastes a specification section into a chatbot to tighten the wording. An engineer uploads a marked drawing set to an AI rendering service. On a defense project, either one can put controlled unclassified information (CUI) into a cloud service that has never shown FedRAMP Moderate equivalency, and DFARS 252.204-7012 makes that the firm's problem. This guide covers which AI tools can handle CUI, six controls that keep it out of the rest, and what to do if it gets in.

Why does CUI need special handling in AI tools?

CUI needs special handling because the contract clause that governs it reaches every cloud service that touches it, and most AI tools are cloud services. DFARS 252.204-7012 requires contractors to protect covered defense information with the controls in NIST SP 800-171. When a contractor uses an external cloud service to store, process or transmit that information, paragraph (b)(2)(ii)(D) requires the provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to follow the clause's incident reporting and forensic requirements.

Pasting a specification section into a chatbot, uploading a drawing set to an AI rendering service, or letting an AI notetaker transcribe a design review all send information to the AI provider for processing. If that information is CUI, the provider has to clear the same bar as the firm's file storage and email.

Two requirements in NIST SP 800-171 Rev. 2 speak to this directly. Requirement 3.1.3 says to "control the flow of CUI in accordance with approved authorizations," and requirement 3.1.22 says to "control CUI posted or processed on publicly accessible systems." A public AI service is a publicly accessible system.

Does the CMMC pause change any of this?

No. The Department of War suspended CMMC Phase 2 requirements on July 13, 2026, which postponed the third-party certification requirements that were due to start appearing in solicitations on November 10, 2026. The same release kept DFARS 7012 obligations and NIST SP 800-171 Rev 2 self-assessments in place. A contractor with 7012 in its contracts has the same duty to protect CUI today that it had before the pause, and the Department of Justice's Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that knowingly misrepresent their cybersecurity practices. For the full list of what stays in force, see what still applies during the CMMC pause.

Which AI tools meet FedRAMP Moderate equivalency for CUI?

Only AI tools that meet FedRAMP Moderate or FedRAMP Moderate equivalency, and that your system security plan already covers, can handle CUI. If a vendor cannot show that standard for the specific AI service, the tool is out of bounds for CUI.

DoD set out what equivalency means in a December 21, 2023 memorandum on FedRAMP Moderate equivalency: the cloud offering must meet 100 percent of the FedRAMP Moderate baseline, validated by a FedRAMP-recognized third-party assessment organization, with the evidence available to the contractor. A vendor saying its product is "secure" or "enterprise-grade" is no substitute for that evidence.

Some government cloud environments do carry the authorizations. Microsoft, for example, states that Azure and Azure Government hold FedRAMP High provisional authorizations for in-scope services. The question to ask is whether the specific AI service you want to use is inside that authorization boundary, and whether your contract adds any further restrictions. Confirm both in writing before anyone on the project team uses it.

How do you keep CUI out of AI tools, step by step?

Six steps cover most defense project work at an architecture, engineering or construction firm.

1. Know which projects and files are CUI

The contracting agency decides what is CUI, under the National Archives' CUI program at 32 CFR part 2002. Keep a current list of projects with DFARS 7012 in the contract or subcontract, and ask the contracting officer or prime to clarify markings when drawings, specifications or site data arrive unmarked. Staff cannot protect what they cannot recognize.

2. Keep CUI inside a defined enclave

Store CUI only in the environment your system security plan describes, whether that is a government cloud tenant or a separate, controlled file area. AI assistants built into productivity suites generally work across every file a user can open, so an assistant switched on in your commercial tenant should not have a path to the enclave.

3. Control which AI services enclave users can reach

Use web filtering and application control to block unapproved AI sites and browser extensions on the devices that access CUI. Zero trust network access can limit enclave access to managed, compliant devices, so a personal laptop with a personal AI account never reaches the files in the first place.

4. Add DLP rules for CUI markings

Data loss prevention rules can detect common CUI banner markings, distribution statements and contract numbers, and block or warn when someone pastes or uploads matching content to an AI site. Start in warn mode for a few weeks, review what the rules catch, then switch to block.

5. Train project teams with examples from their own work

Requirement 3.2.1 calls for managers, administrators and users to be aware of the security risks of their activities. Generic AI training misses the cases that matter on a defense project. Use specific examples: rewriting a spec section with a chatbot, generating a rendering from a marked drawing, summarizing an RFI log, or running an AI notetaker on a call with the government client. Tell people what the approved tool is, if there is one, and who to ask when in doubt.

6. Write it into the SSP and the AI policy

Your system security plan should describe how AI tools are handled for CUI, and your AI acceptable use policy should say plainly that CUI does not go into any AI tool outside the approved environment. An assessor reads both, and they need to match what the technical controls actually do.

What if CUI has already gone into an AI tool?

Treat it as a potential cyber incident under DFARS 7012 and start the clock. The clause defines compromise to include unauthorized disclosure of information, intentional or unintentional, and requires contractors to rapidly report cyber incidents to DoD at dibnet.dod.mil, which the clause defines as within 72 hours of discovery.

• Reporting requires a DoD-approved medium assurance certificate. Get one now, before you need it.
• Preserve images of affected systems for at least 90 days from the report, as paragraph (e) requires.
• Subcontractors report to DoD and give the incident report number DoD assigns to the prime or next higher-tier subcontractor as soon as practicable.
• Record what was uploaded, to which service, by whom and when, and what the provider says about retention and deletion.

Whether a specific upload meets the reporting threshold is a judgment for the firm and its counsel. Making that judgment within the 72-hour window is easier when the steps are already written down.

What should your firm do this quarter?

• List every active project with DFARS 7012 in the contract or subcontract.
• Confirm in writing which AI tools, if any, are approved for CUI and that they sit inside your SSP boundary.
• Block unapproved AI sites and extensions on devices that reach the enclave.
• Turn on DLP rules for CUI markings in warn mode, then move to block.
• Run a 30-minute session with each defense project team using examples from their own work.
• Obtain a medium assurance certificate if your firm does not already have one.

How does s90 help?

s90 sets up DLP rules for CUI markings, zero trust access to the CUI enclave, and AI guardrails that keep project teams on approved tools, then documents those controls in language an assessor can follow. If you have defense work in your pipeline and want to check how your AI use lines up with DFARS 7012, we can review it with your team.