CMMC-Compliant AI Deployment: A Practical Guide for Level 2 Contractors
A CMMC-compliant AI deployment is one where every system that stores, processes, or transmits CUI through an AI workflow sits inside your assessed boundary and satisfies the 110 NIST SP 800-171 controls that CMMC Level 2 requires. With the CMMC 2.0 final rule (32 CFR Part 170) effective since December 2024 and Level 2 requirements now appearing in DoD solicitations through the 48 CFR acquisition rule, contractors can no longer defer the question of where AI fits. This guide explains which AI architectures pass assessment, which fail, and how to add AI capability without reopening your entire scoping exercise.
How CMMC 2.0 Treats AI Systems in Your Boundary
CMMC 2.0 does not name AI anywhere, and that is precisely the point: an LLM server is just another CUI asset. Under the official CMMC scoping guidance, any system that processes CUI is in scope, so an AI tool summarizing a technical data package is a CUI Asset subject to all 110 Level 2 practices. A cloud AI API becomes an External Service Provider that must itself meet FedRAMP Moderate or equivalent under DFARS 252.204-7012 paragraph (b)(2)(ii)(D). Most commercial AI SaaS products fail that test outright. Your C3PAO will ask three questions: where do prompts go, where are outputs stored, and who can access the logs. If any answer includes an unassessed third party, you have a finding.
The Controls That Actually Bite: AC, AU, SC, and CM
Four control families do most of the work in an AI assessment conversation. Access Control (3.1.x) demands that the AI cannot surface CUI to users who lack authorization for the source documents, which means retrieval pipelines must enforce document-level permissions, not just application login. Audit and Accountability (3.3.x) requires logging of prompts and responses touching CUI.
- 3.1.3: control CUI flow, meaning retrieval-augmented AI must respect source-document ACLs per query
- 3.3.1/3.3.2: retain prompt and response audit logs tied to individual user identities
- 3.13.8/3.13.11: encrypt CUI in transit and at rest with FIPS-validated cryptography, including vector indexes
- 3.4.1: keep the AI stack (model versions, serving software, GPU drivers) in your configuration baseline
Three Deployment Patterns, Ranked by Assessment Risk
Pattern one, lowest risk: on-prem inference inside your existing CUI enclave, using open-weight models on your own GPUs. Nothing leaves the boundary; the SSP grows by a few components. Pattern two, moderate risk: GovCloud-hosted AI such as Azure OpenAI in Azure Government (FedRAMP High) with a signed BAA-equivalent CUI addendum; workable, but you inherit shared-responsibility documentation work and per-token costs of roughly $10-$60 per million tokens for frontier models. Pattern three, high risk: commercial SaaS AI with enterprise privacy toggles. Privacy settings are not FedRAMP authorization, and assessors have flagged these deployments repeatedly. Contractors choosing pattern one typically spend $40,000-$120,000 upfront but avoid recurring compliance ambiguity entirely.
- On-prem enclave AI: full control, one-time hardware cost, no new external service providers
- FedRAMP High GovCloud AI: viable for CUI with proper contracts, but confirm US-persons support for ITAR
- Commercial AI SaaS with opt-outs: almost never defensible for CUI under DFARS 7012
- Hybrid: keep CUI workloads on-prem, use commercial AI only for clearly non-controlled data with DLP enforcement
Preparing Your SSP and Assessor Conversation
Treat the AI addition as a formal change: update the asset inventory, network diagrams, and data flow diagrams; write control implementation statements for the new components; and run a delta self-assessment against SPRS before your C3PAO visit. Document the model update process explicitly, since assessors increasingly ask how weights enter an enclave that has no direct internet path (the defensible answer is a scanned, hash-verified transfer through your existing media protection process under 3.8.x). Budget two to four weeks of documentation effort. Contractors who show up with a clean data flow diagram and prompt-log samples turn the AI discussion into a ten-minute checkbox instead of a finding.
How Netray Delivers Assessment-Ready AI Deployments
Netray builds on-prem AI systems for CMMC Level 2 contractors with the compliance artifacts included, not bolted on afterward. Every deployment ships with SSP component descriptions, control implementation statements mapped to NIST SP 800-171 Rev 2, data flow diagrams, and a prompt-audit logging configuration that satisfies 3.3.1 out of the box. Our AI agents connect to SyteLine, Infor LN, and document repositories through permission-aware retrieval, so 3.1.3 flow control holds at the query level. Clients have passed C3PAO assessments with Netray AI systems in scope with zero AI-related findings, while cutting quoting and contract-review labor by 40-60 percent.
Frequently Asked Questions
Is ChatGPT Enterprise CMMC compliant for Level 2 contractors?
No enterprise privacy tier makes a commercial AI service CMMC compliant by itself. For CUI, DFARS 252.204-7012 requires cloud providers to meet FedRAMP Moderate or equivalent, and standard ChatGPT Enterprise does not carry that authorization. Contractors handling CUI should use FedRAMP-authorized government cloud AI offerings or deploy models on-premises inside their assessed boundary.
Does an on-prem LLM need to be in my CMMC assessment scope?
Yes, if it processes, stores, or transmits CUI it is a CUI Asset and fully in scope for all 110 Level 2 practices. The efficient approach is to place it inside your existing CUI enclave so it inherits established controls, then update your SSP asset inventory, data flow diagrams, and control statements rather than building a separate boundary.
What NIST 800-171 controls matter most for AI systems?
The heaviest lifts are 3.1.3 (CUI flow control, meaning retrieval must respect document permissions), 3.3.1 and 3.3.2 (auditable prompt and response logs tied to users), 3.13.8 and 3.13.11 (FIPS-validated encryption in transit and at rest, including vector databases), and 3.4.1 (configuration baselines covering model versions and serving software). Nail those four families and the rest follows standard enclave practice.
Key Takeaways
- 1How CMMC 2.0 Treats AI Systems in Your Boundary: CMMC 2.0 does not name AI anywhere, and that is precisely the point: an LLM server is just another CUI asset. Under the official CMMC scoping guidance, any system that processes CUI is in scope, so an AI tool summarizing a technical data package is a CUI Asset subject to all 110 Level 2 practices.
- 2The Controls That Actually Bite: AC, AU, SC, and CM: Four control families do most of the work in an AI assessment conversation. Access Control (3.1.x) demands that the AI cannot surface CUI to users who lack authorization for the source documents, which means retrieval pipelines must enforce document-level permissions, not just application login.
- 3Three Deployment Patterns, Ranked by Assessment Risk: Pattern one, lowest risk: on-prem inference inside your existing CUI enclave, using open-weight models on your own GPUs. Nothing leaves the boundary; the SSP grows by a few components.
Put this into numbers
Free interactive tools for exactly this problem. No signup to use them.
Government Contract Compliance Cost Calculator
Estimate the implementation, assessment, and recurring annual cost of DFARS/CMMC compliance for your DoD business, and see it as a percentage of contract revenue.
Free ToolSovereign AI Readiness Assessment
Score your organization across eleven dimensions of sovereign AI readiness, from data residency and model provenance to cleared personnel and air-gapped operations.
Free ToolAI Agent Use Case Prioritizer
Answer ten questions about a candidate process and get a prioritization score that tells you whether it deserves an AI agent pilot now, later, or never.
Terms used in this article
Get a CMMC-ready AI deployment from Netray with the SSP documentation your C3PAO assessment requires already written.
Related Resources
On-Prem AI for Defense Contractors: The Complete Guide
On-prem AI for defense contractors: deploy LLMs and AI agents inside your CMMC and ITAR boundary. Architecture, hardware costs, timelines, and vendor options.
AI & AutomationAI Governance for Export-Controlled Data (ITAR/EAR)
AI governance for export-controlled data: policies, access controls, and audit trails that keep ITAR and EAR data out of public LLMs and off foreign servers.
AI & AutomationITAR-Compliant AI Tools for Manufacturing: Requirements and Options
ITAR-compliant AI tools for manufacturing: what export control rules mean for LLMs, which vendors qualify, and how to deploy AI without a deemed-export risk.