Safeguarding
AI tools and CUI under CMMC
Start with what the tool can access and which contract requirements apply.
Follow the data path
Record whether each use processes, stores or transmits CUI or FCI, and whether connectors reach systems in the assessment boundary. Treat retrieval access as part of the review. Do not enter that information itself into this website.
Where CMMC stands
Phase II has been suspended since July 13, 2026. Under the current class deviation, Level 1 and Level 2 can be met through self-assessment, and DFARS 252.204-7012 safeguarding duties continue. The Reform Task Force report has not been published. Your self-assessment is your own statement, so AI tools that touch CUI belong in it.
Build a usable evidence record
Record the product, exact deployment, authorized users, allowed data, evidence references and responsible reviewer. An inventory is the start of the review, not evidence that every use is acceptable.
Reviewed October 17, 2026. Recheck before relying on a finding.
Start with what you know
Find the gaps in your AI use.
Get a preliminary view of your tools, data practices and documentation.