# Defense Contractors Scope AI-Built CUI Tools

A discussion of CMMC Level 2 and NIST SP 800-171 Rev. 2 concluded that using AI to develop a tool is not inherently prohibited. The proposed offline document parser would handle Controlled Unclassified Information (CUI), however, so the application should be treated as in scope and addressed through the organization’s security, documentation, change-control, and authorization processes. The discussion distinguished AI used for general coding assistance from AI services that receive CUI, sensitive code, or other protected information.

- Contractors developing or acquiring tools that process CUI should account for the application in their security and authorization processes, regardless of whether AI assisted its development.
- Organizations should assess whether CUI, sensitive code, or other protected information is sent to an AI service; the discussion identifies this as a key distinction for evaluating exposure and scope.
- For procurement teams, the issue is relevant when evaluating contractor development practices and the handling of CUI in proposed software. The signal does not identify a contract, solicitation, or new CMMC requirement.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 16, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)

### Vendors
- Microsoft ()
- Anthropic ()

### Key Quotes
> Inherently - no it's not against the requirements spelled out in 800-171R2.
> — Commenter

### Sources
- [Using ai to CREATE tools for supply chain, is this against cmmc level 2?](https://www.reddit.com/r/CMMC/comments/1x7rt78/using_ai_to_create_tools_for_supply_chain_is_this) - reddit-cmmc