How CMMC 2.0 Treats AI Systems in Your Boundary
0 does not name AI anywhere, and that is precisely the point: an LLM server is just another CUI asset. Under the official CMMC scoping guidance, any system that processes CUI is in scope, so an AI tool summarizing a technical data package is a CUI Asset subject to all 110 Level 2 practices. 204-7012 paragraph (b)(2)(ii)(D).
Most commercial AI SaaS products fail that test outright. Your C3PAO will ask three questions: where do prompts go, where are outputs stored, and who can access the logs. If any answer includes an unassessed third party, you have a finding.
The Controls That Actually Bite: AC, AU, SC, and CM
Four control families do most of the work in an AI assessment conversation. x) demands that the AI cannot surface CUI to users who lack authorization for the source documents, which means retrieval pipelines must enforce document-level permissions, not just application login. x) requires logging of prompts and responses touching CUI.
- 3.1.3: control CUI flow, meaning retrieval-augmented AI must respect source-document ACLs per query
- 3.3.1/3.3.2: retain prompt and response audit logs tied to individual user identities
- 3.13.8/3.13.11: encrypt CUI in transit and at rest with FIPS-validated cryptography, including vector indexes
- 3.4.1: keep the AI stack (model versions, serving software, GPU drivers) in your configuration baseline
Three Deployment Patterns, Ranked by Assessment Risk
Pattern one, lowest risk: on-prem inference inside your existing CUI enclave, using open-weight models on your own GPUs. Nothing leaves the boundary; the SSP grows by a few components. Pattern two, moderate risk: GovCloud-hosted AI such as Azure OpenAI in Azure Government (FedRAMP High) with a signed BAA-equivalent CUI addendum; workable, but you inherit shared-responsibility documentation work and per-token costs of roughly $10-$60 per million tokens for frontier models.
Pattern three, high risk: commercial SaaS AI with enterprise privacy toggles. Privacy settings are not FedRAMP authorization, and assessors have flagged these deployments repeatedly. Contractors choosing pattern one typically spend $40,000-$120,000 upfront but avoid recurring compliance ambiguity entirely.
- On-prem enclave AI: full control, one-time hardware cost, no new external service providers
- FedRAMP High GovCloud AI: viable for CUI with proper contracts, but confirm US-persons support for ITAR
- Commercial AI SaaS with opt-outs: almost never defensible for CUI under DFARS 7012
- Hybrid: keep CUI workloads on-prem, use commercial AI only for clearly non-controlled data with DLP enforcement
Try it here, free
Government Contract Compliance Cost Calculator
Estimate the implementation, assessment, and recurring annual cost of DFARS/CMMC compliance for your DoD business, and see it as a percentage of contract revenue.
Preparing Your SSP and Assessor Conversation
Treat the AI addition as a formal change: update the asset inventory, network diagrams, and data flow diagrams; write control implementation statements for the new components; and run a delta self-assessment against SPRS before your C3PAO visit. x). Budget two to four weeks of documentation effort.
Contractors who show up with a clean data flow diagram and prompt-log samples turn the AI discussion into a ten-minute checkbox instead of a finding.
How Netray Delivers Assessment-Ready AI Deployments
Netray builds on-prem AI systems for CMMC Level 2 contractors with the compliance artifacts included, not bolted on afterward. 1 out of the box. 3 flow control holds at the query level.
Clients have passed C3PAO assessments with Netray AI systems in scope with zero AI-related findings, while cutting quoting and contract-review labor by 40-60 percent.
Frequently asked questions
Is ChatGPT Enterprise CMMC compliant for Level 2 contractors?
No enterprise privacy tier makes a commercial AI service CMMC compliant by itself. For CUI, DFARS 252.204-7012 requires cloud providers to meet FedRAMP Moderate or equivalent, and standard ChatGPT Enterprise does not carry that authorization. Contractors handling CUI should use FedRAMP-authorized government cloud AI offerings or deploy models on-premises inside their assessed boundary.
Does an on-prem LLM need to be in my CMMC assessment scope?
Yes, if it processes, stores, or transmits CUI it is a CUI Asset and fully in scope for all 110 Level 2 practices. The efficient approach is to place it inside your existing CUI enclave so it inherits established controls, then update your SSP asset inventory, data flow diagrams, and control statements rather than building a separate boundary.
What NIST 800-171 controls matter most for AI systems?
The heaviest lifts are 3.1.3 (CUI flow control, meaning retrieval must respect document permissions), 3.3.1 and 3.3.2 (auditable prompt and response logs tied to users), 3.13.8 and 3.13.11 (FIPS-validated encryption in transit and at rest, including vector databases), and 3.4.1 (configuration baselines covering model versions and serving software). Nail those four families and the rest follows standard enclave practice.
Get a CMMC-ready AI deployment from Netray with the SSP documentation your C3PAO assessment requires already written.