L3Harris
- Written approval before you use AI on an order
- An inventory of your AI systems and use cases
- Labeling and human review of AI-generated deliverables
- Notice within 72 hours of an AI-related incident
Services
Services for agencies, primes and their suppliers.
Government services for agencies and primes, and a focused AI-use readiness service for defense subcontractors.
Government services
Program, AI governance and authorization support for federal, state and local agencies, and for primes that need a small business teammate.
Program and product delivery
Plans, schedules, risks and reporting for software and AI programs, run to a steady cadence with clear owners.
AI governance and RMF/ATO readiness support
Map AI systems to NIST SP 800-53 and the NIST AI RMF, organize the evidence and prepare packages for assessors.
Agile delivery leadership
Release planning, delivery governance and coaching for teams that build and ship software.
Technical evaluation support
Structured review of vendor-delivered AI work against requirements, written so the government can act on it.
AI-use readiness for defense subcontractors
Kendrake reviews how your team uses AI tools like ChatGPT, Copilot and Claude against your primes' supplier terms. In ten business days you get a decision for each use, a fix list with owners, and a two-page summary you can send your prime.
AI-Use Readiness Sprint
Ten business days. A use register, scoped findings, a fix list with owners, an acceptable use policy and a two-page AI use summary.
Free readiness check
Answer 18 questions about the tools your staff use, the data they touch and the terms on your orders. No login, no government data.
Prime AI clause checker
Pick the primes you supply and how your team uses AI. Your answers never leave your browser.
AI clauses are now in prime supplier terms.
These are the published terms of three large primes. Which ones bind you depends on what your purchase orders incorporate.
Northrop Grumman
- No training or testing AI on Northrop information
- AI use only when access is limited and nothing is retained
- Outputs with Northrop information treated as Northrop information
Lockheed Martin
CorpDoc 2 (2026), section 20(e)
- Lockheed information in AI only as the contract requires
- No export-controlled information in AI tools
- Traceability of AI-generated content on request
- Evidence you follow the DoD Ethical AI Principles on request
CUI rules did not pause either. CMMC Phase II is suspended, but DFARS 252.204-7012 and your self-assessment still apply to any AI tool that touches CUI. Read the prime terms guide
Questions that come up
Primary sources
- CMMC Phase II suspension implementation guidance
- GSAR 552.239-7001, class deviation RGO-2026-01
- Lockheed Martin CorpDoc 2 (2026), section 20(e)
- Northrop Grumman CTM-P-ST-002 (Rev. 05/06/2026), clause 22(M)
- L3Harris LGL-50.F1 (Rev. 05/2026), articles 9(b), 15(g) and 17
Reviewed October 17, 2026. Recheck before relying on a finding.
Is the GSA AI clause final?
GSA released the final language of clause 552.239-7001 on October 13, 2026, under class deviation RGO-2026-01. Its effective date is October 19, 2026, and GSA plans to add it to Multiple Award Schedule contracts in Refresh 34 on November 6, 2026. It covers LLM functionality the government buys, including AI-enabled document and productivity tools, when Government Data goes into or comes out of the LLM. Unless the contracting officer identifies otherwise, contractor-internal tools not delivered to or accessed by the government fall outside it. Check the terms on the actual contract. If you deliver LLM functionality to a GSA customer, review it now.
Do primes really put AI rules in supplier terms?
Yes. Lockheed Martin, Northrop Grumman and L3Harris all publish 2026 supplier terms with AI clauses. Depending on the prime, they limit what information can go into AI tools, require written approval before AI use, ask for an AI inventory or let the prime request traceability of AI-generated content. The Prime supplier terms guide summarizes each one with its source.
Does CMMC cover our AI tools?
It depends on what the tool can reach. An AI tool that processes, stores or transmits CUI sits inside your assessment scope. Phase II third-party assessments are suspended, but self-assessments and DFARS safeguarding duties continue.
Are we in scope if we only use Copilot?
The name alone does not answer that. The exact offering, configuration, connectors, data and contract terms matter. The check identifies what needs review.
Is this legal advice?
No. This is readiness and documentation support. Contract interpretation goes to your attorney. Technical acceptance and business approval remain with the customer.
What do you store?
Forms collect only the metadata requested. Do not send government data, CUI, prompts, model outputs or contract text. Anonymous check answers are processed without email delivery. Requested reports, inquiries and surveys are delivered by email to Kendrake; contact details are collected only when you provide them. See Privacy for the handling and retention policy.
How long does it take?
The free check is designed for under 10 minutes for a small sample of tools. The paid sprint takes 10 business days after scope and required inputs are confirmed. Open fixes may take longer.
Guides
Prime supplier terms
Prime supplier AI terms and each reported use
Large primes now write AI rules into their supplier terms. Map each AI use to the terms on your purchase orders.
SafeguardingAI tools and CUI under CMMC
Start with what the tool can access and which contract requirements apply.
Contract termsGSA AI clause 552.239-7001
Review the issued text and the procurement it applies to.
Agency directionOMB M-25-22 and M-26-04 for contractors
Agency policy and a contractor obligation are different steps in the review.
Developing requirementsNDAA Section 1513 and AI security
Congress has directed an AI security framework for defense contractors. Here is what is known and how to prepare.
Customer evidenceHow to answer a prime contractor AI questionnaire
Answer from records you can support, and make uncertainty visible.
Partners
CMMC and RMF consultants, cybersecurity firms, GSA Schedule consultants and government contracts attorneys can bring Kendrake into client work.