Can CUI go into an AI assistant?

# CUI AI service-scope decision tree

Synthetic contract and data scenario. The fixture contains no CUI or export-controlled technical information. No provider approval or CMMC assessment result is represented.

A fictional contractor considers AI drafting and a security intermediary. The tree identifies the evidence required before any actual controlled-data use.

| Question | Finding | Next outcome |
| --- | --- | --- |
| Applicable contract and data category established? | No or unknown | Resolve with the contract/data owner before transmitting the proposed controlled information. |
| Information is CUI or covered defense information in scope? | Yes in the fictional scenario | Identify every storing, processing and transmitting service. |
| Information falls outside that category? | Established no for the assessed material | Review other confidentiality/export obligations; no blanket tool approval follows. |
| External provider is a cloud service handling covered information? | Yes | Obtain evidence for the applicable DFARS cloud requirements and incident obligations. |
| Level 2 ESP processes CUI or security protection data? | Yes | Apply the relevant 170.19(c) provider category and document SSP/service/CRM responsibilities. |
| A security intermediary handles only selected event data? | Data category not established | Assess whether it includes security protection data; do not assume automatic exclusion. |
| Required service evidence is missing? | Yes | Keep the proposed controlled-data path unapproved until the accountable review resolves it. |
| Unrestricted synthetic fixture only? | Yes | Use it for a scoped test without presenting the result as CUI authorisation. |

## Review steps

- Establish the contractual data scope: Record the originator, applicable clauses, information category and permitted recipients.
- Review each provider boundary: Distinguish cloud/non-cloud, CUI/security protection data and the actual service evidence.
- Keep the assessment handoff: Connect the data-flow map, system security plan and customer responsibility matrix to the accountable decision.

## Unrestricted synthetic fixture

This is a teaching note about an invented office bracket. It contains no controlled design, dimensions, materials or defence use. Rewrite a generic maintenance reminder without adding technical information.

## Fictional review record

Contract reference: CONTRACT-EX-28.
Controlled-data assumption: a separate proposed record is assumed CUI for the exercise; it is not included in this pack.
Recipients: proposed AI service and proposed security intermediary.
Provider evidence: to be obtained for the actual services before real-data use.
Control test: not run.
Authorisation to use CUI: none represented.

Record actual evidence rather than replacing missing provider requirements with a test result.

## Source and scope

Guide: https://aona.ai/resources/guides/cui-ai-assistants-cmmc/

Source check: 21 September 2026. General information, not professional approval or a completed control test.

- DFARS 252.204-7012: Safeguarding covered defense information: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.
- 32 CFR 170.19: CMMC scoping: https://www.law.cornell.edu/cfr/text/32/170.19

Question,Finding,Next outcome
Applicable contract and data category established?,No or unknown,Resolve with the contract/data owner before transmitting the proposed controlled information.
Information is CUI or covered defense information in scope?,Yes in the fictional scenario,"Identify every storing, processing and transmitting service."
Information falls outside that category?,Established no for the assessed material,Review other confidentiality/export obligations; no blanket tool approval follows.
External provider is a cloud service handling covered information?,Yes,Obtain evidence for the applicable DFARS cloud requirements and incident obligations.
Level 2 ESP processes CUI or security protection data?,Yes,Apply the relevant 170.19(c) provider category and document SSP/service/CRM responsibilities.
A security intermediary handles only selected event data?,Data category not established,Assess whether it includes security protection data; do not assume automatic exclusion.
Required service evidence is missing?,Yes,Keep the proposed controlled-data path unapproved until the accountable review resolves it.
Unrestricted synthetic fixture only?,Yes,Use it for a scoped test without presenting the result as CUI authorisation.

UNRESTRICTED SYNTHETIC TEACHING INPUT, NOT CUI
Rewrite a generic office-maintenance reminder. No controlled design, dimensions, materials, customer information or defence application is supplied. Do not invent technical detail.