AI in a CMMC-Scoped Environment: What’s Actually Allowed

In a companion post I argued that the question “can we use AI if we handle CUI” is the wrong one, because the rules do not care about AI — they care about where your data goes and whether you can prove it. That post was about the risk.

This one is about the tools. Which specific products are actually authorized, at what level, and what an assessor will accept as proof. As of the end of August 2026, with the authorizations verified rather than assumed.

Fair warning on one section: I resell Google Workspace, and Google’s Gemini story has a real gap in it that most resellers gloss over. I am going to tell you where that gap is.

The fork that decides everything

Before any product comparison, you need the rule that sorts them, because it is binary and it is unforgiving.

32 CFR 170.19 governs external service providers. An ESP is “external people, technology, or facilities that an organization utilizes for provision and management of IT and/or cybersecurity services.” A cloud service provider is “an external company that provides cloud services based on cloud computing.” Then the rule forks:

• If the ESP handling your CUI is a CSP: “The CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012.” FedRAMP Moderate, or documented equivalency. Full stop.
• If the ESP handling your CUI is not a CSP: “The services provided by the ESP are in the OSA’s assessment scope and shall be assessed as part of the OSA’s assessment.”

A commercial AI service is a cloud service provider. There is no third branch where a vendor’s good intentions substitute for either path.

And no, AI is not a “specialized asset”

I have heard this argued and it does not work. 32 CFR 170.19 defines the asset categories, and Specialized Assets is a closed list: IoT, IIoT, operational technology, government furnished equipment, restricted information systems, and test equipment. AI services are not in it, and you cannot reason your way in.

Category	Where AI lands	Assessed against
CUI Asset	Any AI tool used with CUI	All Level 2 requirements
Security Protection Asset	An AI security tool that protects the enclave but never touches CUI	Relevant Level 2 requirements
Contractor Risk Managed Asset	A tool genuinely blocked from CUI by policy and technical control	SSP review; limited checks if deficiencies suspected
Specialized Asset	Nothing. AI is not in the enumerated list.	—

Every one of the first three categories requires the same three artifacts: the tool in your asset inventory, its treatment described in your SSP, and its presence on your network diagram. Even Contractor Risk Managed Assets. A shadow AI tool is by definition missing from all three.

What is actually authorized

Verified against vendor compliance documentation and the FedRAMP Marketplace as of August 2026.

Offering	Authorization	DoD Impact Level
Azure OpenAI Service (Azure Government)	FedRAMP High	IL4, IL5, IL6, ICD 503
Microsoft 365 Copilot — GCC High	FedRAMP High, DFARS, ITAR/EAR	—
Microsoft 365 Copilot — DoD	—	IL5
Claude, Llama, GPT-OSS, Nemotron on Amazon Bedrock (GovCloud)	FedRAMP High	IL4, IL5
Claude for Government	FedRAMP High	IL4/IL5 via Bedrock; IL6 via AWS Secret regions
Gemini for Government (on GCP, inside Assured Workloads)	FedRAMP High	IL4 (some features pending)
Gemini in Google Workspace + the Gemini app	FedRAMP High	Not authorized at IL4 or IL5
OpenAI ChatGPT Enterprise and API Platform	FedRAMP Certified, Class C (Moderate), Jan 2026	—

A note on the FedRAMP vocabulary, because it is shifting under everyone’s feet. The 2026 Consolidated Rules replace the Low/Moderate/High baselines with Certification Classes A through D and replace “Authorization” with “Certification.” Class C is the Moderate successor — that is how OpenAI’s listing reads. Optional adoption began July 4, 2026; legacy Rev5 becomes unavailable June 11, 2027.

Which creates a genuine problem nobody has resolved: DFARS 7012 still says “FedRAMP Moderate baseline,” and the December 2023 DoD CIO equivalency memo still demands a body of evidence built from artifacts that FedRAMP is in the process of renaming or eliminating. I found no DoD CIO update, rescission, or successor guidance. The memo has not been withdrawn; the terminology it depends on is being retired underneath it. If you are pursuing the equivalency path, this is worth watching closely.

Microsoft: the most complete path, with real feature gaps

Microsoft 365 Copilot reached general availability in GCC High in December 2025 and is available across GCC, GCC High and DoD. GCC High carries FedRAMP High plus DFARS and ITAR/EAR coverage and is Microsoft’s stated environment for CUI. The DoD environment runs at IL5. Prompts, responses and generated content stay in the government cloud.

Azure OpenAI Service in Azure Government is the strongest authorization posture of anything on this list: FedRAMP High and IL4/IL5 since September 2024, IL6 in the Secret cloud since February 2025, and ICD 503 in Top Secret.

The part Microsoft’s marketing does not lead with: Copilot in GCC High is not the same product as Copilot in commercial. Not available or limited today —

• Copilot Search
• OneDrive integration
• SharePoint agents and the built-in agents (Researcher, Analyst)
• Power Platform connectors
• The Mac desktop app
• Teams meeting transcription, and Teams chat and channel Copilot support
• Web grounding through Bing — disabled by default in GCC High, specifically to prevent spillage

That last one is the right design decision and it is also the reason a user who tried Copilot at home will find the GCC High version disappointing. Set expectations before you buy seats, not after.

Google: FedRAMP High yes, Impact Level no

Here is the section I promised to be careful with.

What is true and often doubted: Gemini in Workspace apps — Docs, Drive, Gmail, Meet, Sheets, Slides — and the standalone Gemini app achieved FedRAMP High authorization in March 2025, the first generative AI assistants in a productivity suite to do so. Google’s own compliance scope table confirms it, and Google’s admin guidance states there is no requirement to disable Gemini to stay within FedRAMP scope.

What is also true and rarely mentioned: in that same scope table, no Gemini service is marked authorized at DoD IL2, IL4 or IL5. Only Gemini in Meet carries a “DISA review” marking for IL5. Workspace holds a FedRAMP High provisional ATO, and the core apps themselves are marked “DISA review” for IL5.

So if a contract or a prime asks for IL4 or IL5, Workspace Gemini is not the answer today. If the requirement is FedRAMP Moderate equivalency under DFARS 7012 — which is what most small contractors actually face — FedRAMP High is more than sufficient.

What Assured Controls Plus actually adds

Both Assured Controls and Assured Controls Plus are paid add-ons available with Enterprise Plus or Frontline Plus. Both include Access Approvals, client-side encryption, compliance data exports, data regions, local data storage, policy compliance logging and Meet compliance recording.

Exactly one feature separates them: Access Management, which restricts access to your data to personnel with defined attributes — U.S.-based personnel, EU-based personnel, or individuals with FBI background checks.

That single feature is the one that matters if your CUI is also ITAR technical data, because it is what addresses the deemed-export concern about who at the provider can reach your content. If you are not export-controlled, the delta is narrower than the price difference suggests. Buy it for a reason.

Three things not to get wrong:

• Assured Controls is not Assured Workloads. Different products. Assured Controls is a Workspace add-on. Assured Workloads is a Google Cloud construct, and Gemini for Government on GCP requires deployment inside an Assured Workloads folder configured for FedRAMP High or IL4 with US multi-region residency. People conflate these constantly, including some vendor comparison articles.
• Configuration is load-bearing. Google’s FedRAMP guide requires admins to restrict users to FedRAMP-authorized services and set the data region policy to the United States. An out-of-the-box Enterprise Plus tenant is not automatically inside the boundary. Licensing is not compliance.
• Get the boundary question answered in writing. Whether a commercial Enterprise Plus tenant, configured per Google’s FedRAMP guide, sits legally inside Google’s FedRAMP High authorization boundary for DFARS 7012 purposes is a question I could not resolve from public documentation. The configuration guide implies yes. I have not found an explicit Google statement. If you are betting a contract on it, ask Google directly and keep the answer.

Running the model yourself

This is the option small shops overlook, and structurally it is the cleanest.

DFARS 7012(b)(2)(ii)(D) is triggered only “if the Contractor intends to use an external cloud service provider.” If open-weight models run on hardware you own, inside your own CUI enclave, with nothing leaving the boundary, there is no external CSP — so there is no FedRAMP obligation, because there is no provider to authorize. A capable open model on a single GPU server is within reach of a fifteen-person company now in a way it was not two years ago.

What does not go away is all of NIST SP 800-171. The inference server is a CUI Asset and gets treated like one:

• 3.13.11 — FIPS-validated cryptography protecting CUI. Applies to the model host and the inference endpoint like anything else.
• 3.1.x — access control on the endpoint. An unauthenticated inference API inside your enclave is an unauthenticated interface to your CUI.
• 3.3.x — audit and accountability. And note what this means: prompt and completion logs containing CUI are CUI at rest.
• Configuration management, media protection, and the rest of the families.

Two traps specific to self-hosting that I have not seen anyone else write down:

Your vector store is a CUI repository. If you build retrieval-augmented generation over your CUI documents, that index inherits every control the documents have. It is not metadata. It is your CUI in a different shape, usually in a database nobody put on the network diagram.

Fine-tuning on CUI produces weights that may embed it. Treat the resulting model file as a CUI artifact, not as software. Which means it does not get copied to a laptop, pushed to a public model hub, or handed to a contractor for evaluation.

One model you may not run at all

Section 1532 of the FY2026 NDAA: “No contractor may, during the period of performance of such contractor under a contract with the Department of Defense, use covered artificial intelligence.” Covered AI includes anything developed by DeepSeek or by High Flyer and affiliated entities, and the surrounding definitions reach entities domiciled in China, Russia, Iran or North Korea.

The prohibition is on use, not on transmission — so downloading the weights and running them air-gapped does not cure it. Llama, Mistral and gpt-oss are not named and are not covered. Qwen and other PRC-origin models warrant screening before anyone pulls them down.

Worth noting that gpt-oss models are now served inside a FedRAMP High / IL5 boundary on Bedrock in GovCloud, with zero operator access. For a lot of small contractors that is easier than standing up and maintaining your own inference stack — you get open-weight models without owning the compliance burden of the hardware.

What an assessor will actually accept

This is the distinction the whole post is built toward.

DFARS 7012 requires you to “require and ensure” that the provider meets security requirements equivalent to the FedRAMP Moderate baseline. That is a controls standard — hundreds of controls across seventeen families, independently tested. A vendor promise not to train on your data addresses exactly one concern. It says nothing about FIPS-validated encryption, personnel screening, boundary protection, incident response, continuous monitoring, supply chain, physical security or configuration management.

Three tiers of evidence, in order:

1. Best — a FedRAMP authorization for the specific offering, verifiable on the Marketplace. You inherit a documented, tested control set and you show the listing. This is a five-minute conversation with an assessor.
2. Acceptable but heavy — a full equivalency body of evidence under the December 21, 2023 DoD CIO memo: SSP, security assessment plan, security assessment report, POA&M and continuous monitoring artifacts, from a FedRAMP-recognized 3PAO, at 100% compliance with no open POA&Ms. Note who has to hold that package: you, not the vendor. If a vendor will not give it to you, you do not have equivalency.
3. Not sufficient on its own — a marketing page, a data processing agreement, a SOC 2 Type II, an ISO 27001 or ISO 42001 certificate, or a “we don’t train on your data” clause.

That third tier is where most companies think they are safe. There is a middle ground worth knowing — Anthropic, for instance, has a third-party NIST attestation for CUI use on Claude Enterprise, available under NDA. That is materially stronger than a marketing claim. It is still not a FedRAMP authorization, and an assessor may treat it as evidence toward equivalency rather than as equivalency itself.

The line I keep coming back to: a data-use promise is a contract term. FedRAMP is a tested control baseline. An assessor scopes the second. A lawyer argues the first, after something has already gone wrong.

Where to start

If you are a small contractor with a CUI enclave and you want AI in it, the shortest defensible paths today are:

• Already on Microsoft 365 GCC High — Copilot is the least-friction option. Accept the feature gaps.
• Already on Google Workspace Enterprise Plus — Gemini is FedRAMP High and in scope, provided you actually configure the tenant per Google’s FedRAMP guide and set data regions to the U.S. Add Assured Controls Plus if you are export-controlled.
• Building something yourself — Bedrock in GovCloud gets you Claude, Llama and gpt-oss inside FedRAMP High and IL4/IL5 without owning the hardware.
• Want nothing leaving the building — self-host open weights in the enclave and treat the whole stack, logs and vector store included, as CUI assets.

Whichever you pick, the compliance work is the same and it is small: put the tool in the asset inventory, describe it in the SSP, draw it on the network diagram, and keep the authorization evidence where you can produce it. That is the whole difference between an AI capability and an audit finding.

---

Where to go next

• Not sure whether your environment is scoped correctly to begin with? Take the CMMC readiness quiz.
• Our CMMC guide for small contractors covers enclave design and asset categories in plain language.
• Need the SSP and network diagram that make any of this defensible? Start with our CMMC packets.