The problem with 'just use AI'
For a defense contractor, every AI capability is also a data-flow decision. A retrieval pipeline that indexes your file shares indexes your CUI. A model endpoint outside the boundary is an uncontrolled egress path. An answer without traceability is a system your assessor can't accept. The opportunity is real — but it has to be engineered inside the compliance perimeter, not bolted on beside it.
What we build
- CUI-safe architectures & RAG — retrieval and generation pipelines scoped to the CUI boundary, with Purview labeling and DLP enforced at every hop.
- Auditable, explainable models — logging, access control, and decision traceability packaged as evidence artifacts an assessor can test.
- GCC High & Azure Government native — deployed inside the federal cloud, not bolted on through commercial endpoints.
- Risk addressed at design time — data-leakage paths, model export-control exposure under ITAR/EAR, and compliance drift addressed at design time, not discovered at assessment.
- Integration with your existing stack — Purview, Defender, Intune, and WDAC extended to cover the AI workload, so one control implementation keeps carrying the whole environment.
Questions contractors ask us
Can we use AI on CUI at all?
Yes — if the entire pipeline stays inside your CUI boundary and satisfies the same controls as any other system that processes CUI. What you cannot do is paste CUI into a commercial AI endpoint outside the boundary. Compliant AI means the model, the retrieval layer, and the logs all live where your assessment can see them.
What does 'auditable AI' actually mean?
Logging, access control, and decision traceability packaged as evidence artifacts an assessor can test: who queried what, which documents fed which answer, and what controls gated access. If you can't produce that trail, the AI system is an assessment finding waiting to happen.
Does ITAR apply to AI models?
It can. A model trained on export-controlled technical data can itself embody controlled technology, and model weights or outputs can constitute an export if exposed to foreign persons. We engineer that risk out at design time — deployment location, access control, and training-data governance — rather than discovering it at audit.
Scope an AI project that survives an assessor.
Tell us the use case — document intelligence, proposal support, engineering search — and we'll map it to a boundary-safe architecture. Or email rj@indirectit.com directly.