Who this is for
Defense and aerospace contractors whose teams use generative AI assistants, AI features inside SaaS tools, or build models of their own, and who need to show a customer, an assessor, or a board that the use is known, bounded, and reviewed. It is also the starting point for organizations that sell into Europe and need to understand where the EU AI Act (Regulation (EU) 2024/1689) touches their products.
If the immediate problem is running an AI project safely inside a CUI boundary, start with Compliant AI Implementation. Governance is the program that decides which of those projects should exist at all, and on what terms.
What we deliver
AI system & use-case inventory
Discovery of sanctioned and shadow AI use: assistants, embedded SaaS features, developer tools, and in-house models, each with an owner, data classes touched, and deployment context.
Risk tiering method
A use-case risk method mapped to the NIST AI RMF Map and Measure functions: impact, data sensitivity (CUI, export-controlled, personal data), autonomy, and human oversight.
Policy & acceptable use
An AI policy and acceptable-use standard people can follow: approved tools, prohibited data, review gates, and disclosure rules. Written to sit beside your existing CUI and export-control policies.
Oversight & accountability
Roles, an AI review board sized to your organization, and a change process that catches new models and new data before they go live, the Govern function made operational.
ISO/IEC 42001 readiness
For organizations pursuing certification: AI management system scope, AI risk and impact assessment, Statement of Applicability against Annex A, and internal audit ahead of a certification body.
EU AI Act applicability
Where you place AI systems on the EU market or your outputs are used there, we map each system against the Act's risk categories and phased obligations so counsel can confirm the position.
How it reuses your CMMC program
| AI governance need | Already in your CUI program | What gets added |
|---|---|---|
| Know what systems exist | Asset inventory and CUI boundary (3.4.1, 3.13.x) | AI-specific fields: model, provider, data used for training or prompts |
| Control what data goes in | CUI marking, Purview labels, DLP | Prompt and upload rules per risk tier |
| Decide who may use it | Entra ID access control, Conditional Access | Tool approval tied to role and tier |
| Review changes | Configuration and change management | Model and use-case change review |
| Handle incidents | Incident response and DFARS 7012 reporting | AI incident categories: data exposure, harmful output, model misuse |
A note on scope: AI governance decisions often carry legal questions: IP ownership, export control of model outputs, and EU AI Act classification. We build the program and the evidence; your counsel makes the legal determinations, and the program records them.
How an engagement runs
- Discover (2–3 weeks): inventory AI use, including the tools nobody approved, and classify the data each one touches.
- Decide (2 weeks): agree the risk tiers, the approved-tool list, and who signs off on what.
- Codify (2–4 weeks): policy, acceptable use, review workflow, and training, aligned to the NIST AI RMF functions.
- Operate: quarterly register refresh and review-board support as part of Managed Compliance, with ISO/IEC 42001 certification support where you want the credential.
Questions contractors ask us
Is the NIST AI RMF mandatory for defense contractors?
The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary. It has become the common reference for AI risk because it is flexible and customer questionnaires increasingly ask about it. We use it as the backbone because it maps cleanly to ISO/IEC 42001 if you later want a certifiable management system.
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the international standard for an AI management system (AIMS). Like ISO/IEC 27001, it is certifiable by an accredited certification body and follows the same management-system structure, so organizations with an ISMS can extend it rather than start over.
Does the EU AI Act apply to a US contractor?
It can. The Act applies to providers placing AI systems on the EU market and in some cases to systems whose output is used in the EU, regardless of where the provider is based. Its obligations are phased in over several years. We map your systems against it; your counsel confirms the position.
Can our people use generative AI with CUI?
Only inside an environment authorized for CUI, with the data flows documented in your SSP. That is an implementation question we handle in Compliant AI; the governance program decides which uses are allowed and records the decision.
Find out what AI your organization already runs.
Tell us how your teams use AI today, sanctioned or not, and we'll scope the inventory and risk method. Or email rj@indirectit.com directly.