How to Report a CUI Spill Into an AI Tool Under DFARS 7012

A project engineer on a defense facility job pastes a marked specification section into a public chatbot to clean up the wording. Two days later a colleague notices the CUI banner in the chat history. On a contract with DFARS 252.204-7012, the firm now has a reporting question with a 72-hour clock attached. This scenario walks through DFARS 7012 incident reporting for an AI spill: how to decide whether to report, how to file, what to preserve and who else needs to hear about it.

What counts as a CUI spill into an AI tool?

A spill happens when controlled unclassified information (CUI) reaches a system that is not authorized to hold it. For an AI tool, that usually means pasting, uploading or recording covered defense information into a service that sits outside the environment your system security plan describes and has never shown FedRAMP Moderate equivalency.

DFARS 252.204-7012 defines compromise to include "disclosure of information to unauthorized persons, or a violation of the security policy of a system," and the definition goes on to cover unintentional disclosure and "the copying of information to unauthorized media." It defines a cyber incident as actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system or the information residing in it. DoD's own reporting form treats this kind of event as a recognized category: the DC3 reporting instructions list "unauthorized release (includes inadvertent release)" as a type of compromise.

Common AEC examples include a marked drawing set uploaded to an AI rendering service, an RFI log summarized with a personal chatbot account, or an AI notetaker recording a design review with the government client.

Is an AI upload a reportable cyber incident under DFARS 7012?

It may be, and the firm should assume it is until the review says otherwise. Paragraph (c)(1) requires a contractor that discovers a cyber incident affecting a covered contractor information system or the covered defense information on it to review for evidence of compromise and rapidly report to DoD. The clause defines rapidly as within 72 hours of discovery.

The review under paragraph (c)(1)(i) covers identifying compromised computers, servers, specific data and user accounts. For an AI spill, that means establishing which tool and account received the data, exactly what was shared, whether the material was in fact CUI, and whether the service was inside your authorized boundary. An AI service your SSP already covers, with documented FedRAMP Moderate equivalency, is a different situation from a free public chatbot.

Whether a specific event meets the reporting threshold is a judgment for the firm and its counsel. Making that call inside 72 hours is far easier when the steps below are already written into your incident response plan.

What should happen in the first hour?

In the first hour, stop further exposure and record the facts before anyone deletes the conversation or the account.

• Stop further use of the tool for that project and tell the user not to delete the conversation or the account yet.
• Record who shared what, in which tool, from which device and account, and when. Take screenshots of the conversation and the account type.
• Note the discovery date and time. The 72-hour window runs from discovery.
• Open an incident record. NIST SP 800-171 Rev. 2 requirement 3.6.2 calls for tracking, documenting and reporting incidents to designated officials and authorities inside and outside the organization.
• Pull the vendor's current terms on retention, training and deletion, and save a dated copy.
• Notify the person your plan names as incident lead, and bring in counsel.

How do you file a DFARS 7012 incident report with DoD?

Reports go to DoD's Cyber Crime Center (DC3), and you need a DoD-approved medium assurance certificate before you can file one. Paragraph (c)(3) of the clause requires contractors to have or acquire that certificate. If your firm does not have one, the DC3 instructions say to contact its DCISE team by email or at (410) 981-0104, a line that operates around the clock.

The clause text still names dibnet.dod.mil as the reporting site. Check the current DC3 reporting instructions before you need them, because the report is now built in DoD's Incident Collection Format (ICF). The instructions say contractors shall report "as much of the following information as can be obtained" within 72 hours, including:

• Company name, Unique Entity Identifier and facility CAGE code.
• The affected contract numbers and the contracting officer's contact details.
• The U.S. Government program manager's contact details.
• The date the incident was discovered and the location of the compromise.
• The type of compromise and the incident outcome.
• A narrative of what happened, in time order, and what you have done to contain it.

Report what you know within the window and supplement it later. Paragraph (c)(2) states that the report is treated as information created by or for DoD.

What has to be preserved after the report?

Paragraph (e) requires contractors to preserve and protect images of all known affected information systems and relevant monitoring or packet capture data for at least 90 days from submission of the report. Under paragraph (f), DoD may request access to additional information or equipment for forensic analysis, and under paragraph (g) the contracting officer may request information for a damage assessment.

For an AI spill, the affected system often includes the user's workstation and the user's AI account. Preserve both before anything is wiped or closed. Then ask the AI vendor in writing to delete the content and to confirm deletion, and keep that correspondence in the incident file. Sequence matters: capture your evidence first, then request deletion, and confirm the order with counsel.

Who else needs to know?

Subcontractors report to DoD directly and then pass the result up the chain. Paragraph (m)(2)(ii) requires a subcontractor to give the incident report number DoD assigns to the prime contractor, or the next higher-tier subcontractor, as soon as practicable. If your firm works as a subcontractor, the prime's incident contact belongs in your plan, alongside the other flow-down requirements primes check.

The CUI program rules add a second path. Under 32 CFR 2002.16(a)(6)(iii), agreements that share CUI with non-executive branch entities require them to report non-compliance with handling requirements to the disseminating agency, using methods that agency approves. Read your contract and any information-sharing agreement for those instructions, and check whether your cyber insurance policy requires notice.

Does the CMMC Phase 2 suspension change the reporting duty?

No. The Department of War suspended CMMC Phase 2 requirements on July 13, 2026, which postponed third-party certification requirements in new solicitations. DFARS 252.204-7012 sits in existing contracts and was not part of that suspension, so the 72-hour reporting duty, the certificate requirement and the 90-day preservation rule all still apply. Our summary of what still applies during the CMMC pause covers the rest.

What should your firm do this quarter?

• Confirm which active projects carry DFARS 252.204-7012 in the contract or subcontract.
• Obtain a medium assurance certificate if your firm does not hold one, and record who holds it.
• Add an AI spill scenario to your incident response plan, including the first-hour steps above.
• Save the DC3 instructions, the DCISE phone number and your primes' incident contacts in the plan.
• Run a 30-minute tabletop with one defense project team using an AI spill as the scenario. Requirement 3.6.3 calls for testing the incident response capability.
• Block unapproved AI sites and turn on DLP rules for CUI markings on devices that reach the CUI enclave.

How does s90 help?

s90 monitors AI prompts and uploads on firm devices so a spill is flagged early in the 72-hour window, and our incident response team runs the first-hour steps with you, preserves the evidence and helps assemble the ICF report. We also set the DLP rules and AI guardrails that keep CUI inside the enclave in the first place. If you have defense work and want to test your plan against this scenario, we can run the tabletop with your team.