CMMC-Compliant AI Tools: What's Actually Allowed in 2026

CMMC-compliant AI tools, as of September 2026, come down to a short list: on-premise open-weight models inside your assessed boundary, or a cloud AI service that is FedRAMP Moderate authorized or demonstrably equivalent. Everything else — ChatGPT, Claude.ai, Gemini, and standard-tier API access to any of them — sits outside the boundary NIST SP 800-171 requires for Controlled Unclassified Information, and that has not changed even though CMMC's enforcement mechanics have been in flux all year. Phase 1 self-assessment has been mandatory since November 10, 2025 and remains so; Phase 2's third-party assessments, originally due this November, were suspended by the Department of Defense on July 13, 2026 and that suspension was locked into binding contracting guidance by a September 3 class deviation (Nextgov/FCW). None of that changes what the underlying rule says about AI. This is where CMMC actually stands, why public APIs fail the test regardless of enforcement phase, and the deployment patterns that pass.

Where does CMMC actually stand today?

The current framework runs through two rules: 32 CFR Part 170, the CMMC program rule, and the DFARS clause at 48 CFR 252.204-7021, which puts CMMC requirements into contracts. Both were finalized and published in the Federal Register on September 10, 2025, with a 60-day lead before contract clauses began appearing — so the phased rollout, and Phase 1, started November 10, 2025 (Federal Register, DFARS Case 2019-D041).

• Phase 1 (live since November 10, 2025, still in force). Contractors handling CUI complete a CMMC Level 2 self-assessment against the 110 NIST SP 800-171 controls, submit a score to the Supplier Performance Risk System, and have a senior official affirm continuous compliance. Scores below 110 permit a Plan of Action and Milestones, but open items must close within 180 days.
• Phase 2 (scheduled November 10, 2026 — suspended). This phase would have required most Level 2 contracts to carry a third-party (C3PAO) assessment as a condition of award. The Department of Defense suspended it on July 13, 2026 and launched a CMMC Reform Task Force review of the program (WilmerHale; National Defense Magazine). A September 3, 2026 memo from DoD's principal director for defense pricing, contracting, and acquisition policy went further, directing contracting officers to strip third-party assessment clauses from contracts under a class deviation — a change that requires formal rulemaking to reverse, not a simple policy reversal (Nextgov/FCW).
• What never paused. DFARS 252.204-7012 safeguarding-and-incident-reporting obligations, and the underlying requirement to implement NIST SP 800-171, were never suspended. The suspension paused the assessment mechanism — who verifies your compliance and how — not the security requirements themselves.
• The control baseline is still Revision 2. NIST published SP 800-171 Revision 3 (97 requirements across 17 families, down from 110 across 14) in May 2024, and DoD has signaled an eventual shift, but CMMC Level 2 still assesses against Revision 2 as of this writing. Plan an AI deployment against the 110-control baseline you're actually assessed on today, not the one that may arrive.

For a contractor building an AI program, the practical read is: assume Phase 1 obligations are permanent, treat Phase 2 as paused rather than cancelled, and do not let the suspension read as license to relax the AI-handling question — that question was never phase-dependent.

Why doesn't a public AI API qualify for CUI?

CMMC Level 2 assessment asks a structural question of every system that touches CUI: is it inside an environment implementing the 110 NIST SP 800-171 controls, under your organization's documented boundary? A consumer or standard-tier AI API fails on architecture, independent of how carefully you write prompts or configure retention settings:

• Boundary and flow control (3.13.1, 3.1.3). The moment CUI leaves your network for a third-party inference endpoint, it has crossed the assessed boundary. That is disqualifying by definition — no amount of TLS or vendor SOC 2 attestation brings an external system inside your CMMC scope.
• Logging and retention you don't control. Most AI vendors retain prompts for abuse monitoring, debugging, or a contractually limited period. Even with training opted out, you cannot produce the audit evidence (AU-family controls) an assessor expects, because the logs live on infrastructure you don't operate.
• Training and improvement pipelines. Some consumer tiers use conversation content to improve models by default; even enterprise tiers that disable this still require you to trust a vendor's technical controls rather than demonstrate your own — the opposite of what an assessment verifies.
• Personnel and jurisdiction. Vendor support and operations staff who can theoretically access backend systems are not vetted the way your cleared or designated CUI-handling personnel are, and for defense contractors with ITAR-controlled technical data, that gap is a separate, harder violation on top of the CMMC finding.
• FedRAMP is the one exception, narrowly. CMMC explicitly permits an external cloud service to handle CUI if it is FedRAMP Authorized at Moderate or higher, or meets FedRAMP Moderate equivalency — full compliance with the Moderate baseline evidenced by an SSP, SAP, SAR, and continuous monitoring from a FedRAMP-recognized assessor (Schellman; Baker Tilly). Standard-tier ChatGPT, Claude.ai, and most API-only access to frontier models do not meet this bar. GovCloud-hosted variants of some cloud AI services sometimes do — but that has to be verified against the specific offering, not assumed from the vendor's brand name.

What are the five deployment patterns, and which ones actually clear CUI?

Pattern	CUI allowed?	Controls it satisfies	Cost / complexity
Public consumer AI (ChatGPT, Claude.ai, Gemini free/Plus)	No	None — outside the assessed boundary entirely	Lowest, but disqualifying
Standard-tier commercial API (OpenAI/Anthropic API, no GovCloud)	No	Encryption in transit only; boundary and flow control still fail	Low, still disqualifying
FedRAMP Moderate (or equivalent) GovCloud AI service	Conditionally yes	Boundary control inherited from the CSP's assessed environment, if equivalency is documented	Medium–high: subscription premium plus SSP inheritance mapping
On-premise open-weight deployment, network-connected for updates	Yes, with discipline	Full control ownership — AC, AU, SC, CM implemented and evidenced directly	Medium: hardware plus ongoing ops, smaller assessment surface than a vendor relationship
Fully air-gapped open-weight deployment	Yes, cleanest evidence	Same as above, plus the cleanest possible answer to boundary and flow-control questions	Highest upfront (mirrored dependencies, transfer process); lowest ongoing compliance risk

The middle pattern — FedRAMP Moderate equivalency — is real but underused precisely because it is expensive to verify: you inherit a CSP's controls only as far as their documentation and your mapping of it extend, and an assessor will test that mapping, not just the CSP's paperwork. For contractors handling ITAR-controlled technical data on top of CUI, the last two patterns are usually the only ones that also clear export-control review — the architecture our defense industry practice and air-gapped AI deployment guide both cover in more depth.

How do open weights with no telemetry map to NIST SP 800-171?

Open-weight models change what "AI system" means for an assessor, because the model itself is a static, checksummed artifact rather than a live service with its own network behavior. Deployed correctly, a model like GLM-5.3-Flash (320B MoE, 18B active, MIT-licensed) or Qwen3.8-27B (27B dense, Apache 2.0) contributes nothing to the compliance picture beyond what your surrounding infrastructure provides — which is exactly the point. Neither is "CMMC certified" (no such thing exists for a model), but a deployment built around them can satisfy specific control families directly:

• Access Control (AC). The model sits behind your existing SSO and role-based access, so CUI-scoped conversations are restricted to designated personnel the same way any other CUI system is (3.1.1, 3.1.2).
• Audit and Accountability (AU). Because inference runs on infrastructure you operate, every prompt, response, and access event can be logged to your own append-only store — evidence you produce, not evidence you request from a vendor (3.3.1).
• System and Communications Protection (SC). With weights, serving stack, and dependencies mirrored inside the boundary and no route to the internet, boundary protection (3.13.1) and CUI flow control (3.1.3) have a one-word answer: nothing leaves.
• Configuration Management (CM). Static weight files with published checksums give you a verifiable baseline (3.4.1) — you can prove exactly which model version processed which data, which a frequently-updated hosted API cannot offer.

This is architecture, not certification: your organization still has to implement and evidence the controls, and an assessor still evaluates your environment, not the model card. What open weights remove is the one failure mode no amount of internal control can fix — a vendor's infrastructure sitting inside your data flow.

What should a contractor do in the 90 days before its next assessment?

• Days 1–30: Inventory and stop the bleeding. Catalog every AI tool touching CUI or ITAR-controlled data today, including shadow-IT use of consumer chatbots. Issue an interim policy barring CUI in any tool that isn't FedRAMP Moderate-verified or fully internal, and confirm your SPRS score and POA&M items are current under Phase 1's still-active obligations.
• Days 31–60: Choose and stand up the architecture. For most CUI-handling engineering and program teams, an on-premise deployment — air-gapped if ITAR data is in scope — is the fastest path to a defensible answer, typically six to twelve weeks from assessment to production for a scoped deployment. Map the deployment directly to AC, AU, SC, and CM evidence an assessor will ask for.
• Days 61–90: Document and rehearse. Write the System Security Plan sections covering the AI deployment specifically, generate the audit logs and egress-monitoring evidence a C3PAO or your own self-assessment will expect, and run an internal tabletop against the 110 controls before the real one.

Because Phase 2's third-party assessment mechanism is currently paused, most contractors are self-assessing rather than facing a C3PAO — which makes this the moment to get the AI deployment right on your own terms, before a reinstated Phase 2 makes it someone else's judgment call. Our precision manufacturer air-gapped deployment blueprint is the closest published reference architecture, and our air-gapped AI practice runs this as a standard engagement — enclave design, mirrored dependencies, verified-provenance model transfer, and the SSP language an assessor actually reads.