Is Your Prompt History a CUI Spill?

I have written already about whether you can use AI tools if you handle CUI, and about what it takes to run AI inside a CMMC-scoped environment. This post is about a narrower thing that both of those assume you have already thought about, and almost nobody has.

Not the model. The log.

When someone pastes a paragraph of a technical data package into a chat window to get it rewritten, the interesting question is not what the model does with it in the next four seconds. It is where that paragraph is sitting eighteen months later, on whose infrastructure, under whose retention policy, readable by whom.

A spill is a location problem, not a secrecy problem

A CUI spill is CUI coming to rest in a system that is not authorised to hold it. That is the entire definition, and two things follow from it that people find counterintuitive.

Nobody has to read it. There does not need to be a breach, an attacker, or a disclosure to a person. The CUI being stored somewhere it should not be is the event.

Your intent is not a control. The engineer who pasted the paragraph meant to get a cleaner sentence out of it. Nothing about that intent changes where the text went.

So the question to ask about an AI tool is exactly the question you would ask about any file share: does CUI end up stored there, and is that system inside your authorisation boundary? If the answer is yes and no, in that order, you have a spill — whether or not anyone has done anything wrong.

Everyone asks the wrong question first

The question people ask a vendor is “do you train on my data?” It is the wrong question, or at least a badly incomplete one, and vendors have gotten very good at answering it in a way that closes the conversation.

“We do not train on your data” and “we do not retain your data” are entirely different statements. Almost every consumer and prosumer AI product retains conversation history by default, because conversation history is the product — it is how you scroll back to what you did last Tuesday. Training is one downstream use of retained data. Retention is the thing that creates the spill.

The questions that actually matter, in the order I ask them:

• Where is prompt and output content stored, and in which country?
• For how long, by default, and can we set it to zero?
• Who at the provider can read it, under what circumstances — including trust-and-safety review, abuse investigation and support escalation?
• Is it retained separately for abuse monitoring even when history is disabled?
• What does deletion actually do, on what timeline, and does it cover backups?
• Is any of this contractual, or is it a policy page the vendor can revise on a Tuesday?

That last one decides how much the rest is worth. A published policy is a statement of current practice. A contract term is a commitment. For an enclave that holds CUI, only one of those is evidence.

The clause that decides it

DFARS 252.204-7012 already answers most of this, and it answered it years before anyone was pasting drawings into a chat box.

If you use an external cloud service provider to store, process or transmit covered defense information, that provider has to meet security requirements equivalent to the FedRAMP Moderate baseline, and has to comply with the clause’s incident reporting, media preservation and access provisions. There is no small-quantity exception and no exception for tools people signed up for themselves.

An AI assistant that retains your prompts is storing and processing whatever was in them. If those prompts contained CUI, it is an external cloud service provider under the clause. Most consumer AI products are not FedRAMP Moderate or equivalent, are not going to sign your flow-downs, and will not preserve media for ninety days on request.

That analysis does not require anyone to have an opinion about artificial intelligence. It is the same analysis you would run on a free file-transfer site.

Prompt history is not the only copy

This is the part that surprises people who have already thought about the main chat window. The text takes more paths than you would guess, and several of them are on machines you do control — which is better, but only if you know they exist.

Path	What lands where
Browser extensions and sidebars	Page content and selections, often sent to a third party distinct from the model vendor
IDE and code assistants	Open file contents and surrounding context, sent as completion context; sometimes cached locally in plain text
Meeting note-takers	Full transcripts of conversations that discuss the programme, stored by the note-taking vendor
Mobile keyboards with AI features	Typed text processed off-device depending on settings
Clipboard managers and sync	Every copy operation, retained and synced across devices
Screenshot and OCR features	Images of marked documents, indexed and searchable
Local logs and telemetry	Prompts and responses written to application logs on the endpoint, then swept up by backups

Do the exercise on your own environment before you do it on anyone else’s. In most small shops the answer is that prompts are being retained in at least three places nobody has ever inventoried, and at least one of those is inside the boundary and therefore fixable this week.

How to find out whether it has already happened

Start from the assumption that it has. Everything I have seen says the base rate is not low, and the reason is not carelessness — it is that these tools arrived through the browser rather than through procurement.

• Look at expenses. Corporate card statements and reimbursement claims will show individual AI subscriptions that never went through IT. This is the fastest signal available and it takes twenty minutes.
• Look at identity. Your identity provider knows which third-party applications people have consented to with their work account. In Entra ID or Google Workspace, that list is usually longer than anyone expects.
• Look at the network. If you have egress logging or a proxy, query for the major AI service domains over the last ninety days, by user. If you do not have egress logging, note that as a finding of its own.
• Look at browsers. Enterprise browser management will report installed extensions. Sidebar assistants are the most common unmanaged path into a document.
• Ask people, without consequences attached. A short, plainly worded amnesty note gets better data in a day than a technical audit gets in a month. People will tell you what they used if telling you is not a disciplinary event.

If you find something

I am not a lawyer and this is not legal advice, and this is a place where you should have one. But the sequence I would follow, and the one I would want documented afterward, is:

• Stop the flow first. Revoke the application consent, remove the extension, disable the account. Do this before you start the analysis, because the analysis takes days.
• Establish what was actually in it. The category matters enormously. Export-controlled technical data is a different conversation from procurement-sensitive information, and both are different from someone pasting a paragraph of a public specification they wrongly believed was controlled.
• Preserve, do not clean up. Whatever else is true, do not delete the local evidence of what happened. Preserve the account, the history export, the logs.
• Get counsel involved on the reporting question early. Whether a given spill meets the definition of a reportable cyber incident under 252.204-7012 is a fact-specific analysis with a 72-hour clock attached, and the answer is not automatically no. That is exactly the kind of question you want answered by someone whose advice is privileged, on day one rather than day nine.
• Request deletion, and record what you were told. Ask the provider in writing, keep the response, and be honest with yourself that a deletion confirmation is a vendor’s assertion rather than a verification. You cannot un-send a prompt. You can only document what you did about it.
• Write it down in the SSP. A spill that produced a real change — a blocked domain, a new policy, an approved tool list — should show up in the plan. That is the artifact that makes the response look like a programme instead of a panic.

Preventing the next one

Prohibition does not work here, and I would not recommend trying it. These tools make people materially faster at their jobs, and a ban produces exactly the shadow usage you cannot see. The workable pattern is to make the compliant path the easy one.

• Give people an approved tool. One that lives inside your existing tenant, under your existing agreement, with retention you control. If your CUI already lives in a government-community cloud tenant, the AI features bound to that tenant inherit the boundary you already assessed. That is a far shorter path than authorising something new.
• Set retention to zero where the vendor supports it, and get that in the contract rather than the settings page.
• Block the rest at the network and at consent. Turn off user consent for third-party applications in your identity provider. That single setting closes more paths than any amount of training.
• Say something specific in the acceptable use policy. Not “use good judgment.” Name the approved tools, name the prohibited categories of content, and say what to do after a mistake — because the person who pastes the wrong thing at 4pm needs to know that telling you is the correct next move.
• Log it. If an approved AI tool is in scope, its access logs are audit records like any others, and 3.3.1 does not have an exception for them.

The honest uncertainty

Some of this is unsettled, and I would rather say so than pretend otherwise.

There is no published Department guidance addressing prompt retention as a category. The FAR Council’s proposed CUI rule, published in June 2026, is still a proposed rule and would change the incident-reporting framework if finalised. The CMMC Reform Task Force is expected to report shortly and could move things again. Anyone telling you there is a settled answer about AI tooling and CUI right now is selling something.

What is not unsettled is the underlying test. CUI in a system you have not authorised is a spill. That rule predates every product involved and will outlast most of them, and it is the one to reason from until somebody publishes something better.

So the question is not whether AI is allowed. It is whether you can answer, today, where your prompts are stored and for how long. If you cannot, that is the finding — and it is a finding you can close in a week, which is more than can be said for most of the 110.

---

Where to go next

• Want a quick read on where your gaps are? The CMMC readiness quiz takes about five minutes.
• Our CMMC guide for small contractors covers boundaries, external service providers and what counts as in scope.
• Need the acceptable use policy and the external service provider table written down properly? Start with our CMMC packets.