Use only tools inside an environment approved for CUI: a cloud service at FedRAMP Moderate or above (or an equivalent your prime and system security plan accept), such as Copilot in a GCC High tenant or Claude for Government, or a model on your own assessed systems. Treat standard AI plans as non-CUI until the vendor confirms otherwise in writing.
This is a screening method, not legal or compliance advice. CUI means controlled unclassified information, and your contract, your prime's flow-down terms and your contracting officer (the government official who manages the contract) have the final say on it. The clause behind the answer is DFARS 252.204-7012: when a contractor uses an external cloud service to store, process or transmit covered defense information, the provider must meet security requirements equivalent to the FedRAMP Moderate baseline (FedRAMP is the government's programme for authorising cloud services). An AI chat window is a cloud service in exactly that sense.
The short answer by type of tool
| Type of tool | CUI allowed? | Condition |
|---|---|---|
| Free and consumer AI apps | No | None. Keep them away from anything controlled |
| Standard business plans of the popular AI chat tools | Not unless the vendor confirms in writing | FedRAMP Moderate equivalence for that exact product, the incident duties in the clause, data location, retention and export-control answers |
| AI built into a government-cloud tenant you already use | Possible | The feature must exist in your environment today, your configuration must be right, and your prime must accept it |
| AI sold for government use | Possible | Confirm a contractor can buy it, and that your contract and plan accept it |
| A model on your own assessed systems | Possible | The host sits inside your boundary and no feature calls out to the vendor |
| Any AI on data that is not CUI | Yes | Your normal AI policy, plus the tripwires below |
The rest of this checklist is how to get from "possible" to a written yes or a clear no. I checked the vendors' own pages on 29 October 2026 and quote what they say. Where a page would not load, I say so rather than guess.
Step zero: is the data CUI, FCI or neither?
Screen the data before the tool. CUI is information that requires safeguarding or dissemination controls but is not classified. DFARS 252.204-7012 narrows that for contractors into covered defense information (CDI): unclassified controlled technical information or other information described in the CUI Registry that is marked or identified in the contract and provided by or for the Department of Defense (DoD), or that you collect, develop, receive, use or store in performing the contract. The clause defines controlled technical information as "technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination".
One level down sits Federal contract information (FCI), a defined term in contracts: information not intended for public release that is provided by or generated for the government under a contract. Information made public and simple transactional data, such as payment processing, are excluded. The basic safeguarding clause for FCI lists 15 controls and does not override the rules for CUI.
| Category | Typical examples in a small shop | What it means for AI |
|---|---|---|
| CUI or CDI | Drawings and specifications with distribution statements, test reports, process sheets for controlled parts, emails that quote their part numbers | Only environments that meet the clause's conditions |
| FCI | Purchase-order acknowledgements, contract schedules, delivery paperwork | Lower tier, but not for consumer AI; ask your prime what it expects |
| Neither | Website copy, job adverts, generic HR templates, public brochures | Normal business AI use under your policy |
To find out which you hold, read the contract and subcontract for DFARS 252.204-7012 and any export-control or CUI clauses. Look for markings and distribution statements on what your prime sends. Then ask your prime in writing. Paragraph (m) of the clause makes the prime responsible for determining whether a subcontractor's information still counts as CDI, and for consulting the contracting officer if needed. If nobody has answered, treat the data as CUI until someone does.
Five questions on where the data goes and who can see it
Send these to the vendor in writing and file the replies with a date.
| # | Ask the vendor | Why it matters | Red flag |
|---|---|---|---|
| A1 | Where are prompts, uploaded files and outputs processed and stored, including backups and logs? | The clause puts any external cloud service that stores, processes or transmits CDI in scope | A region named, but nothing about logs, backups or support tools |
| A2 | Who can access customer content: engineers, support staff, subprocessors? How are they screened? | Export-controlled data has access limits. Microsoft's own page lists data location, legal jurisdiction and access by screened personnel among the requirements that led to its government clouds | "Our staff worldwide may access data to improve the service" |
| A3 | Which model providers and subprocessors touch the data, and is the same service sold in more than one environment? | One model can be authorised in one environment and not in another | An app wrapped around someone else's model that cannot name it |
| A4 | How long are prompts, outputs, files and logs kept, including after deletion and under "zero retention"? | Retention widens your incident scope | "As long as necessary" |
| A5 | Is content used for training, evaluation or human review, and can that be switched off in the contract? | Defaults usually favour the vendor on consumer plans | A user-level setting but no contractual commitment |
A3 is easy to miss, and Anthropic's government page shows why. It says Claude for Government is Anthropic's FedRAMP High authorised product and that CUI is authorised in it, while Claude Enterprise and the Claude API from Anthropic are not FedRAMP authorised today; for the API it points to Amazon Bedrock in a government cloud region or Google Vertex AI with Assured Workloads, both listed as FedRAMP High. Same company, same family of models, different answers by environment. Always ask about the exact product and route.
On A4, retention can change under you. Anthropic's documentation, as recorded in September 2026, says that since 9 June 2026 prompts and outputs on its most capable models are kept for 30 days even for zero-data-retention customers, with a by-application route back to zero retention added in September; check the current page. OpenAI's help text, as recorded in earlier checks, says deleted ChatGPT chats are removed within 30 days and that Temporary Chat copies may be kept up to 30 days for safety. "Deleted" rarely means "gone today". The general questions behind A1 to A5 are covered in questions to ask before buying AI that touches client data and what zero data retention means.
Six questions on compliance evidence and incident duties
| # | Ask the vendor or your prime | Why it matters | Red flag |
|---|---|---|---|
| B1 | Is this exact product FedRAMP authorised at Moderate or above, or does the vendor claim equivalence? Show the listing and its scope | Paragraph (b)(2)(ii)(D) requires "security requirements equivalent to" the FedRAMP Moderate baseline | A company-wide logo with no product named |
| B2 | Will you comply with paragraphs (c) to (g) of the clause: reporting incidents within 72 hours of discovery, submitting malicious software, preserving media for at least 90 days, giving access for forensic analysis, and damage assessment? | The same sub-paragraph requires the provider to comply with them | "Our standard incident process applies", with no timings |
| B3 | Which security controls do you cover and which are mine? Can you supply a responsibility matrix? | Your system security plan has to show who does what, and assessors ask | No matrix, or "you are responsible for everything" |
| B4 | What independent evidence exists: authorisation, third-party assessment, attestation, SOC 2 report? | An attestation is not an authorisation. Anthropic says Claude Enterprise has a third-party NIST SP 800-171 Revision 3 attestation under NDA, and that it is not a government authorisation or a CMMC certification | Treating SOC 2 or ISO 27001 as the answer to B1 |
| B5 | Is the service designed for export-controlled data? If not, which environment is? | Anthropic's page says Claude Enterprise "isn't designed for export-controlled data" and directs ITAR users to a government-region cloud environment | Silence, or "contact sales" with no written answer |
| B6 | Which version of NIST SP 800-171 does my contract cite, and has my prime or contracting officer accepted this tool in writing? | The clause points to the version in effect when the solicitation was issued, or one the contracting officer authorises | Assuming the newest revision applies |
ITAR and EAR, the International Traffic in Arms Regulations and the Export Administration Regulations, are the export-control regimes for arms-related and dual-use technical data. They limit who may see the data, which is why A2 asks about staff access and B5 asks about export-controlled data.
Revision 3 of NIST SP 800-171 (May 2024) superseded Revision 2, which was withdrawn on 14 May 2024. The publication pages do not say which revision a given DoD contract uses, so B6 has to be answered from your contract. If a tool cannot meet a requirement, the clause provides a route: a request to vary from NIST SP 800-171 goes in writing to the contracting officer, and a subcontractor must tell the prime when it makes one. You do not decide a variance yourself.
CMMC, the DoD's certification programme, builds on NIST SP 800-171. Its phase-in dates have shifted before, so check the current schedule with your prime or a CMMC adviser rather than trusting a date on any web page, this tutorial included. The cloud requirement in the clause applies to contracts that include the clause, whatever the CMMC timetable says. The wider vendor-security background is in SOC 2 and ISO 27001 explained and what to check in an AI vendor's data processing agreement.
Six questions about how your own team will use the tool
| # | Ask yourself | Why it matters | Red flag |
|---|---|---|---|
| C1 | Which features pull other data in: connectors, plugins, memory, projects, meeting bots, browser extensions, agents? | A tool that is fine with pasted text can read your whole file store once connected | Switched on by default |
| C2 | Can staff sign up with personal accounts on work devices, and do you enforce single sign-on? | Shadow use bypasses every answer above | No inventory of accounts |
| C3 | Which software you already own has AI features switched on, or about to be? | Vendors change defaults. One note-taking vendor opted new users in to keeping de-identified transcripts from 16 June 2026 | Features added in an update nobody read |
| C4 | For a "local" tool, does any model or feature call out to the vendor's servers? | Ollama models whose names end in :cloud run on Ollama's servers | Model names nobody has checked |
| C5 | Where do outputs go: chat history, downloads, email, shared links? | Text generated from CUI can itself be CUI | Histories saved automatically on a vendor server |
| C6 | Can you export logs showing who used the tool, when, and on which files? | You need evidence for an assessor and for an incident | No admin log |
C1 and C2 are where most leaks happen, and neither depends on the vendor. Staff-side controls are covered in how to stop staff pasting client data into free tools. For C4, running AI on your own computers explains what "local" does and does not buy you. A model's licence is a separate matter from its security: Gemma 4, for example, is released under the Apache 2.0 licence, which says nothing about where it runs.
What four vendors say today, and what they leave open
| Product | What its own page says (read 29 October 2026) | What that does not settle |
|---|---|---|
| Microsoft 365 Copilot in a government cloud | Microsoft Learn (updated 8 October 2026) says GCC High is for contractors that handle CUI and whose contracts require FedRAMP High, DFARS or ITAR/EAR compliance. Copilot is available in GCC, GCC High and DoD and runs entirely within the customer's own government cloud tenant, with prompts and responses staying in that cloud; features may differ and lag commercial releases; the customer remains responsible for configuration | Which Copilot features exist in your tenant today, and whether your tenant is that type at all |
| Anthropic's Claude | Claude for Government is FedRAMP High authorised and CUI is authorised in it; the page says it is available to agencies and to organisations that support government work, such as contractors. Claude Enterprise is not FedRAMP authorised today and is not designed for export-controlled data; Anthropic says it is pursuing FedRAMP Moderate for it, with no confirmed timeline. The Claude API from Anthropic is not FedRAMP authorised. Bedrock in a government cloud region is listed as FedRAMP High and approved for DoD impact levels IL4 and IL5 | Whether a subcontractor of your size qualifies for the government product and on what terms, and whether a Bedrock route fits the environment you already run |
| Google (Gemini in Workspace; Assured Workloads) | Google's Workspace privacy hub (updated October 2026) says Gemini in Workspace apps and the Gemini app have FedRAMP High authorisation, while Gemini Notebook and Gemini in Chrome do not support FedRAMP compliance; it does not mention CUI, ITAR or DoD impact levels. Google Cloud's Assured Workloads page lists data boundaries including IL2, IL4 and IL5, ITAR, and FedRAMP Moderate and High, and says "support for Google Cloud products and services varies by control package" | Whether Google will commit in writing to the clause's incident duties for your account, where your Gemini data is processed, and whether every feature your staff use sits inside the authorised scope |
| OpenAI's ChatGPT | OpenAI's government, privacy and help pages could not be loaded when this tutorial was checked, so it makes no claim about authorisation levels. OpenAI's help centre does refer to separate FedRAMP Enterprise workspaces, which points to a FedRAMP edition distinct from the ordinary plans | Everything for the edition you would buy: authorisation level and scope, data location, retention, export-controlled data, and whether a subcontractor can buy it |
| A model on your own assessed systems | No vendor statement needed, but your own plan must cover the host | Whether any feature calls out to the internet |
Three lessons. First, a vendor name is not a status: the answer changes with the product, the plan and the environment. Second, the page that would settle your case is often a "supported products by control package" list, and it may not exist for the feature you want. Ask for it by name, with Workspace, Copilot or the exact feature written in the request. Third, an authorisation answers one of the seventeen questions, not all of them. Google's FedRAMP High statement for Gemini in Workspace settles B1 for those products, but A1, B2 and B5 still need written answers before any CUI goes in.
Pass, hold or stop: how to score the answers
Score each of the 17 questions. Pass means a specific written answer that names the product and carries a date. Hold means vague, partial or "we will check". Stop means the answer shows the tool cannot meet the requirement. The rule: any Stop on A1, A3, A4, B1, B2 or B5 ends the review for CUI use, and any Hold on those means no CUI until it is resolved. A Stop does not ban the tool for work that is not CUI.
| Result | What it means | What you do |
|---|---|---|
| Pass | A specific written answer, naming the product, with a date | File it with the tool's record in your system security plan |
| Hold | Vague, partial or "we will check" | No CUI until it is resolved; ask again in writing |
| Stop | The answer shows the requirement cannot be met | No CUI; the tool can still serve work that is not CUI |
Seventeen Passes still do not give you permission. They give you a file to take to your prime, who decides whether the tool goes into your plan. Do not wait for a perfect score on questions that do not apply, such as C4 for a tool that has no local mode; mark them "not applicable" and say why.
A 14-person machine shop screens two tools
Take a machine shop with 14 staff (illustrative) that makes brackets and housings for a prime. Six people handle drawings and test reports, and the subcontract includes DFARS 252.204-7012. The owner wants two tools: an AI meeting-notes app for the weekly programme call with the prime, and a chat assistant for work instructions and supplier emails.
Step zero first. The programme call covers drawing revisions and test results, which is controlled technical information, so it is CUI. Work instructions derived from the drawings are CUI too. Supplier emails that quote part numbers are CUI, while emails that only discuss delivery terms are not. Then the shop sends the 17 questions to each vendor. The notes app's replies (illustrative) look like this:
| Question | Vendor's reply | Result |
|---|---|---|
| A1 Data location | A named cloud region; backups and support logs not mentioned | Hold |
| A3 Subprocessors | A third-party transcription service and a third-party model; names not given | Stop |
| A4 Retention | Audio deleted after 30 days; transcripts kept until the user deletes them | Hold |
| B1 FedRAMP | None; SOC 2 Type II only | Stop |
| B2 Incident duties | "Standard incident process", no timings | Stop |
| C1 Features | Joins calls as a bot; connects to calendar and email | Hold |
Across all 17 questions the app scored 5 Pass, 6 Hold and 6 Stop. With Stops on A3, B1 and B2 the result is no CUI. The shop keeps human minutes for the programme call and bans the bot from that meeting. It may still use the app for internal calls that discuss nothing technical, with the owner's approval.
The chat assistant's vendor answers in writing that business accounts are not used for training by default, content is kept for 30 days and the customer can choose a storage region. It holds no FedRAMP authorisation and says nothing on export-controlled data. B1 and B5 are a Stop and a Hold, so no CUI. The shop adopts it for non-CUI work only, with the tripwires and rule card below. Screening took about three hours per tool in the owner's own time, but the vendors' replies took a week or more, so start before anyone asks to use the tool.
A questionnaire you can send a vendor this week
Subject: Written answers needed: [product name], plan [plan name]
Hello [first name],
We are a small subcontractor on a DoD contract that includes DFARS 252.204-7012. Before any controlled information goes near your product, we need written, dated answers about the exact product and plan named above.
1. Where are prompts, uploaded files, outputs, logs and backups processed and stored?
2. Who can access customer content (staff, support, subprocessors), and how are they screened?
3. Which model providers and subprocessors see our data? Is the same service offered in other environments?
4. How long are prompts, outputs, files and logs kept, including after deletion and under zero retention?
5. Is our content used for training, evaluation or human review? Can that be switched off in the contract?
6. Is this exact product FedRAMP authorised at Moderate or above, or do you claim equivalence? Please attach the listing and its scope.
7. Will you comply with paragraphs (c) to (g) of DFARS 252.204-7012: 72-hour incident reporting, malicious software submission, 90-day media preservation, forensic access and damage assessment?
8. Which controls do you cover, and which are ours? Please provide a responsibility matrix.
9. Is the product designed for export-controlled data? If not, which of your offerings is?
10. Can we export usage logs showing who used the product, when and on which files?
Please reply with answers we can file, and tell us if any answer depends on a plan or feature we have not named.
Thank you, [your name]Reply quality tells you something before the content does. A vendor that answers each numbered question in specific terms is easier to work with than one that sends a marketing PDF. A broader list of general vendor questions is the first of the further reads below.
Tripwires for AI use that stays outside CUI
A tool that fails screening can still do useful work on material that is not CUI, if the line is clear. Give staff a list of tripwires, things that must never appear in a prompt, upload or dictation:
- Part numbers, drawing numbers and revision letters.
- Test results, tolerances, loads and materials tied to a controlled part.
- Any document carrying a CUI banner, a distribution statement or export-control wording.
- Contract numbers and programme names tied to controlled work.
- Photos of drawings, travellers or shop-floor setups.
Redaction is harder than it looks, because a paragraph of harmless details can add up to something controlled. Here is a before and after (illustrative):
| Prompt as written | Problem | Safer version |
|---|---|---|
| "Rewrite this to our supplier: the 6061 bracket, drawing 48-221 rev C, failed the 4.2 kN pull test on lot 17, so we need a corrective-action plan for the anodising by Friday." | Drawing number, revision, test value and lot all appear | "Rewrite this to a supplier: a part from the last lot failed our test, so we need a corrective-action plan for the coating process by Friday. I will add the part details myself." |
Even the safer version may be sensitive if the programme is identifiable from context, so redaction is a judgement your compliance lead owns, not the person typing. Pair the tripwires with a rule card at every workstation:
AI rule card
1. Never paste, upload or dictate anything marked CUI, or any drawing, specification, test result or part number, into an AI tool unless IT has approved that tool for CUI in writing.
2. Use only the tools on the approved list. No personal accounts on work devices.
3. Switch off meeting recorders and AI note-takers on any call about a controlled programme.
4. If you think you pasted something you should not have, stop and tell [compliance lead] straight away. Do not try to fix it yourself.
5. Ask [compliance lead] before you use a tool, not after.Back the card with technical controls: block consumer AI sites on devices that touch CUI, require single sign-on for approved tools, and turn off AI features by default in software you already own until someone has screened them. For the policy side, the usage-policy tutorials in the further reads give a starting point, and your compliance adviser should adapt it to your contract.
Re-checking: vendor answers go out of date
A written answer is a snapshot. Date it, file it with the tool's record in your system security plan, and set a reminder to ask again every six months. Ask again sooner when the vendor emails about updated terms, renames or merges a product, adds an AI feature to software you already own, or when your contract changes. Real examples of change are easy to find: a retention default that moved on 9 June 2026, a transcript default that flipped for new users on 16 June 2026, and government-cloud features that Microsoft says may lag commercial releases. Treat any "preview" or "beta" feature as out of scope for CUI until the vendor puts its status in writing.
Finally, keep the owner of the decision clear. The vendor supplies facts. Your system security plan records what you decided. Your prime or contracting officer accepts or rejects it. A compliance adviser who knows your contract can sign off the rest. If you find a tool that passes, the work is not over: update the plan, tell your prime and train the people who will use it.
Questions a small subcontractor asks about AI and CUI
Is a vendor's SOC 2 report enough to use its AI with CUI?
No. SOC 2 and ISO 27001 describe a vendor's general controls. They are not FedRAMP authorisations, and they do not show that a cloud service meets security requirements equivalent to the FedRAMP Moderate baseline, which is what DFARS 252.204-7012 asks for when a provider handles covered defense information. Treat them as supporting evidence, then ask the FedRAMP question separately.
Does running an open model on my own laptop solve the problem?
It removes the outside cloud provider, but not your own obligations. The laptop and every file it touches must sit inside your assessed boundary, and the tool must make no outside calls. Check the details: some models with local-sounding names run on the vendor's servers, including Ollama models whose names end in :cloud. Update your system security plan before you start.
Who decides whether I can use a particular AI tool with CUI?
Not the vendor's marketing page and not your IT provider alone. Your contract and the clauses flowed down by your prime set the rules, your system security plan records what is in scope, and your prime or contracting officer can accept or reject a tool. Ask for the decision in writing, and involve a compliance adviser who knows your contract.
What should we do if someone already pasted CUI into a chatbot?
Stop using that account for the task, do not try to clean it up yourself, and tell your compliance lead the same day. DFARS 252.204-7012 sets a 72-hour reporting window that runs from discovery of a cyber incident affecting covered information, and your lead decides whether this qualifies and who to notify. Write down what was pasted, when, and in which tool.
Can we use AI on proposals for DoD work?
Often yes, if the content is not CUI. Public solicitation text is not CUI by itself, but attachments, technical data and anything carrying a marking may be. Draft from your own capability statements and past public material, keep part numbers and technical details out of prompts, and ask your compliance lead where the line sits for each bid.
Further reads
- Questions to Ask an AI Vendor Before You Sign Anything — General questions for any AI vendor before you sign.
- Where Is Your Data Stored When You Use AI Tools? — How to find out where an AI tool keeps your data.
- Cloud AI vs On-Device AI: Which Is Safer for Business Data? — Which is safer for business data, cloud or local.
- How to Write an AI Usage Policy for Your Small Business — Write a usage policy staff will actually follow.
- How to Roll Out an AI Policy So Staff Actually Follow It — Roll out the policy so people follow it.
- How to Anonymise Client Data Before You Paste It Into AI — Strip identifying details before pasting text into AI.
- How to Evaluate an AI Software Vendor: A Small Business Scorecard — A scorecard for judging any AI software vendor.
- AI Tools for Shop Drawings: Checking Fabrication Drawings Against the Spec — How a steel or mechanical subcontractor can use ChatGPT, Claude and Bluebeam to compare drawings with the spec, and the checks that must stay human.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: DFARS clause 252.204-7012 (text on the Legal Information Institute site), the basic safeguarding clause for Federal contract information (FCI), the NIST SP 800-171 Revision 2 publication page, Microsoft Learn's page on government cloud environments for Microsoft 365 and Copilot (updated 8 October 2026), Anthropic's government solutions page, Google Workspace's generative AI privacy hub (updated October 2026) and Google Cloud's Assured Workloads overview, all read on 29 October 2026. OpenAI's pages returned errors and are not relied on.