What Government Contractors Must Implement When Using AI in Systems That Process Controlled Unclassified Information

Defense and federal contractors using artificial intelligence tools to process, store or transmit Controlled Unclassified Information (CUI) must implement specific controls that satisfy existing regulatory obligations. The introduction of AI does not create new compliance frameworks, but it does require contractors to apply established NIST 800-171 and CMMC requirements to systems and services that may not have existed when those controls were first implemented.

The central question is not whether AI is permitted, but whether its use can be demonstrated to meet the same security requirements that apply to any system handling CUI. This article explains what must be in place, who is accountable, and what leadership should do next.

Why This Matters to Defense Contractor Leadership

The consequence of using AI tools improperly with CUI is the same as any other security control failure: loss of certification, contract ineligibility, and potential liability for unauthorized disclosure. CMMC certification requires demonstrable compliance with NIST 800-171 controls across all systems that process CUI, and assessors do not distinguish between traditional applications and AI services when evaluating whether those controls are satisfied.

Leadership is accountable for a security outcome without necessarily understanding the technical path to achieve it. The risk is that AI tools are adopted for productivity or capability reasons by program teams or functional departments without consideration of where CUI flows, how the vendor handles data, or what documentation is required to demonstrate compliance during assessment.

The business problem is not the technology itself. It is the absence of a clear owner who can answer whether a given use of AI satisfies existing obligations, what residency and access requirements apply, and how decisions are documented for audit.

What the Regulations Actually Require

NIST 800-171 establishes 110 security requirements organized into 14 families. When an AI tool or service processes CUI, the same requirements apply as for any other system component. There is no separate AI annex or exception. The relevant controls include access control, audit and accountability, identification and authentication, system and communications protection, and media protection, among others.

CMMC builds on NIST 800-171 by requiring third-party assessment of those controls at specified maturity levels depending on contract requirements. An organization cannot achieve or maintain CMMC certification if CUI is processed by systems or services that do not satisfy the required controls, regardless of whether those systems use AI.

Data Residency and Boundary Requirements

CUI must remain within a defined and controlled environment. When an AI service processes CUI, the contractor must establish where data is stored, whether it crosses boundaries outside the accredited environment, and whether the vendor's infrastructure satisfies federal requirements for data residency and protection.

Cloud-based AI services present particular considerations. If CUI is transmitted to a vendor's environment for processing, that environment must either be FedRAMP authorized at the appropriate level, or the contractor must implement compensating controls and document the residual risk. Many commercial AI services store and process data in multi-tenant environments that do not meet these requirements. Using such a service with CUI, even inadvertently, constitutes a control failure.

Access Controls and Authentication

NIST 800-171 requires that access to CUI be limited to authorized users and that systems enforce multi-factor authentication. When an AI tool is used, the contractor must demonstrate that only authorized personnel can submit CUI to the system, that authentication mechanisms meet federal standards, and that access is logged and auditable.

This is not satisfied by a general corporate login. The controls must be applied specifically to the system or service handling CUI, and the contractor must be able to produce evidence of implementation during assessment. If an AI service does not support the required authentication methods or does not provide adequate audit logs, it cannot be used with CUI without a documented Plan of Action and Milestones (POA&M) and acceptance of residual risk by an authorized official.

Vendor Due Diligence and Third-Party Risk

NIST 800-171 includes requirements for supply chain risk management and for ensuring that external service providers protect CUI consistent with the contractor's obligations. Before using an AI service with CUI, the contractor must assess whether the vendor can satisfy these requirements and obtain contractual commitments that align with federal standards.

This assessment should address data handling practices, subprocessor arrangements, data retention and deletion, incident response obligations, and the vendor's willingness to support audit and assessment activities. A vendor that cannot or will not provide this information presents an unmitigable risk when CUI is involved.

The contractor remains responsible for compliance even when using a third-party service. Vendor assurances must be documented, and reliance on those assurances must be justified in the System Security Plan (SSP).

What Must Be Documented for CMMC Compliance

CMMC assessment requires evidence that controls are implemented and effective. For AI systems processing CUI, the documentation must include the same artifacts required for any other system component. This includes entries in the System Security Plan describing the system, how it handles CUI, and which controls apply; configuration records demonstrating that required settings are in place; access control policies and logs; vendor assessments and contractual agreements; and Plans of Action and Milestones for any controls that are not fully implemented.

The absence of documentation is treated the same as the absence of a control. Leadership should not assume that technical implementation is sufficient. The requirement is for documented, auditable evidence that the control exists and functions as described.

Who Inside the Organization Is Accountable

Accountability for compliance with NIST 800-171 and CMMC ultimately rests with executive leadership, but the operational responsibilities are typically distributed across several functions without clear coordination. IT may manage the technical environment. Compliance teams may track documentation. Program managers may approve tool adoption. Legal or contracts may negotiate vendor terms. Without a single point of accountability, CUI can flow into non-compliant systems because no one function has visibility or authority across the entire decision path.

Adequate ownership requires an individual with authority to assess risk, interpret regulatory requirements in context, make binding decisions about what is permitted, and ensure that those decisions are documented and enforced. In larger organizations this role is often filled by a Chief Information Security Officer. In smaller contractors or those without dedicated security leadership, the gap is real and consequential.

This is the governance layer that [virtual CISO leadership](/vciso/) is designed to provide: not the performance of technical tasks, but the executive accountability, regulatory interpretation, risk decisions and documentation discipline that compliance depends on. The vCISO establishes what must be true before an AI tool may be used with CUI, ensures that the necessary assessments and approvals occur, and produces the documentation that assessors will require.

AI and Emerging Technology Governance

AI governance in the defense contractor context is not primarily about the ethical use of algorithms or model transparency, though those considerations may apply in specific circumstances. It is about ensuring that the introduction of new technology does not create compliance gaps in environments where regulatory obligations are already well established.

Effective governance includes a defined process for evaluating new tools before adoption, clear criteria for what constitutes acceptable use with CUI, vendor assessment and approval procedures, technical controls that enforce policy, and documentation practices that will satisfy assessment requirements. These elements are not specific to AI; they apply to any emerging technology that might intersect with controlled information.

The NIST Cybersecurity Framework provides a structure for managing cybersecurity risk that can be adapted to emerging technology evaluation. The framework emphasizes governance, risk assessment and supply chain management functions that are directly relevant to AI adoption in regulated environments.

Practical Next Steps for Leadership

Leadership should begin by establishing a clear answer to a single question: who is accountable for determining whether a given system or service may be used with CUI? That individual or role must have the authority to say no, the knowledge to interpret regulatory requirements, and the responsibility to maintain the documentation that compliance depends on.

Next, conduct an inventory of AI tools and services currently in use or under consideration, and determine which of them might come into contact with CUI. This is not a technical audit; it is a business process review that identifies where CUI flows and which tools intersect with those flows. Many organizations discover that CUI has broader reach within their operations than leadership previously understood.

For each identified system, assess whether the required NIST 800-171 controls are demonstrably in place. If they are not, determine whether the gap can be closed through configuration, vendor cooperation or compensating controls, or whether use of the tool with CUI must be prohibited until compliance can be established. Document the decision and the basis for it.

Establish a formal process for evaluating new technology before adoption in CUI environments. The process should require a written assessment of data residency, access controls, vendor risk and documentation readiness before any tool is approved. The assessment should be performed by or reviewed by the individual accountable for compliance, and the results should be retained as part of the System Security Plan.

If your organization does not have dedicated security leadership with the authority and expertise to perform these functions, recognize that the gap will not close on its own. The alternative to building that capability internally is to engage it as a service. Virtual CISO leadership provides the executive ownership, regulatory judgment and governance discipline that compliance requires, without the overhead of a full-time hire.

If you are uncertain whether your current approach will satisfy assessment requirements, or if accountability for these decisions is unclear within your organization, a confidential consultation can establish what must be in place and whether outside leadership would be appropriate. That conversation is offered without obligation and can be arranged by contacting Heights Consulting Group directly.