Artificial intelligence is moving quickly into federal procurement. But for government contractors, the conversation is no longer simply about how agencies will buy or use AI.
The next question is becoming increasingly important: How will the government require contractors to secure it?
Defense contractors have spent years preparing for cybersecurity requirements surrounding Federal Contract Information (FCI), Controlled Unclassified Information (CUI), NIST SP 800-171 and the Cybersecurity Maturity Model Certification (CMMC) program.
Now AI introduces another layer of risk. AI systems can involve sensitive data, third-party platforms, cloud infrastructure, proprietary models and government information.
So, is AI the next CMMC? Not exactly. But it is something defense contractors should be watching.
Why Is AI Security Becoming a Government Contracting Issue?
AI is becoming part of federal operations, from software development and logistics to cybersecurity, intelligence, data analysis and mission support. Agencies are not simply buying AI products. They are relying on AI-enabled systems that may collect, process, generate, transmit or store sensitive government information.
The Department of Defense has already recognized that AI presents security concerns beyond those associated with traditional information systems, including risks involving data, models, infrastructure and the security of AI throughout its lifecycle.
For contractors, this matters because cybersecurity and acquisition requirements rarely operate in separate lanes. As AI becomes more integrated into federal systems, how those systems are secured could increasingly affect what agencies require from contractors.
Once the government determines that a technology creates a risk to federal information, systems or missions, the questions often become:
- What security requirements must contractors meet?
- How will contractors demonstrate compliance?
- Will those requirements appear in solicitations and contracts?
Those are familiar questions for anyone who has followed the evolution of CMMC.
Is There an “AI CMMC” Requirement Today?
No. At least, not today.
There is currently no separate “AI CMMC” certification program requiring defense contractors to obtain an AI-specific CMMC level. However, the federal government is developing policies, security frameworks and acquisition approaches around artificial intelligence.
More importantly, the connection between AI security and CMMC is no longer theoretical. Section 1513 of the FY2026 National Defense Authorization Act directs DoD to develop a security framework for AI and machine-learning technologies acquired by the Department and incorporate that framework into the DFARS and CMMC program. [https://www.crowell.com/en/insights/client-alerts/cmmc-for-ai-defense-policy-law-imposes-ai-security-framework-and-requirements-on-contractors]
The issue is not whether contractors need an AI certification tomorrow. It is whether companies using AI in support of federal contracts are preparing for the security expectations that could follow.
What Makes AI Different From Traditional Cybersecurity?
Traditional cybersecurity focuses heavily on protecting systems, networks and information. AI adds another layer because information may move through models, third-party platforms, cloud services and tools that were not part of a contractor’s original cybersecurity environment.
That raises concerns around sensitive data, model security, third-party AI tools and access to information. An employee using a commercial AI platform, for example, may be entering information into a system the company never considered part of its federal contracting environment.
That is where AI starts to complicate an otherwise familiar cybersecurity picture.
How Could AI Security Intersect With CMMC?
CMMC is ultimately about protecting sensitive unclassified information within the Defense Industrial Base, and AI does not change those obligations. If a contractor uses AI to process, store or transmit FCI or CUI, it still needs to understand whether that environment meets applicable cybersecurity requirements.
Contractors should be asking:
- Are employees entering CUI into generative AI tools?
- Does our System Security Plan account for AI-enabled systems touching CUI?
- Are our AI vendors or cloud providers part of the environment handling protected information?
- Do we know where prompts, outputs and uploaded documents are stored?
- Can information entered into an AI system be retained or used by the provider?
- Have AI tools expanded our cybersecurity boundary without us realizing it?
That last question may be one of the most important. A contractor may have spent significant time defining its cybersecurity environment, only to find that employees are using AI tools that were never part of that original picture.
That can change the company’s risk quickly.
But CMMC Itself Is Currently Changing
The timing makes this discussion even more interesting. In July 2026, the Department suspended advancement into CMMC Phase II while it reviews the program. But that suspension did not eliminate contractor cybersecurity obligations. Phase I self-assessment requirements remain in effect, and defense contractors handling covered defense information continue to have safeguarding obligations under DFARS 252.204-7012 and the applicable version of NIST SP 800-171.
At the same time, the government’s use of AI continues to expand.
As DoD reexamines how it verifies cybersecurity compliance, contractors should be watching where AI fits into that conversation. The requirements may not ultimately look like CMMC, but the core concerns are similar: What information is being protected? Who has access to it? And how will contractors demonstrate that they are protecting it?
Which Federal Contractors Should Be Paying Attention Now?
This issue goes well beyond companies developing AI and machine-learning systems.
Contractors integrating commercial AI tools, developing software, operating cloud environments or providing data analytics, cybersecurity and digital transformation services should also be paying attention.
Then there is everyday AI use. Employees may be using generative AI to research, draft documents, analyze information or write code connected to government work. Contractors may also rely on vendors and subcontractors that have incorporated AI into their own products and services.
That means AI-related risk can enter a federal contracting environment even when AI is not the product being sold.
For contractors handling CUI or other sensitive government information, the better question is:
Where are we using AI, what information is it touching and do we understand the risk?
What Should Defense Contractors Be Doing Right Now?
Contractors do not need to wait for a new regulation to understand their exposure.
A good place to start is knowing how AI is already being used across the organization.
Companies should know which AI platforms employees are using, what information is being entered into them and whether government documents, FCI, CUI or proprietary information could be involved.
The same questions should extend to vendors and subcontractors.
Companies should also begin looking at their AI and cybersecurity policies together. If AI is touching the same information, systems or contract work covered by a company’s cybersecurity obligations, the two are already connected.
Understanding that now will make it easier to respond as federal requirements develop.
Contractors Should Watch the Clauses, Not Just the Headlines
Federal AI policy is moving quickly, but contractors should pay particular attention to what eventually makes its way into the acquisition system.
Executive orders, agency memoranda and policy frameworks can show where the government is headed. Solicitation provisions and contract clauses tell contractors what they actually have to do.
Companies should watch developments in the FAR, DFARS, DoD cybersecurity policy and agency-specific acquisition guidance as federal AI requirements evolve.
The biggest change may not arrive with an announcement of a new “AI compliance program.” It could simply appear as a new solicitation requirement, cybersecurity control, contract clause or flow-down obligation.
And by then, contractors may already be expected to comply.
The Bottom Line: AI Compliance Is Becoming a GovCon Issue
AI is moving faster than federal acquisition policy can realistically keep pace.
CMMC showed how cybersecurity can move from a technical concern to something that directly affects federal contracting. AI security could follow a similar path.
An “AI CMMC” program may never exist. But the larger point is becoming harder to ignore:
AI governance, cybersecurity and federal acquisition are beginning to converge.
For government contractors, understanding that connection now will be easier than trying to catch up once new requirements begin appearing in solicitations and contracts.
How Can Contractors Build AI Into a More Integrated Compliance Environment?
As AI becomes more connected to cybersecurity, compliance and contract performance, contractors may also want to look at integrated tools that bring these functions together rather than managing them across disconnected systems.
Platforms such as 1Ramp can help government contractors centralize compliance activities, contract management, documentation and AI-enabled workflows within a more connected operating environment. As federal requirements continue to evolve, having greater visibility across these functions can help contractors understand where AI is being used, how it connects to their broader compliance environment and where potential risks may need attention.
For contractors thinking about what comes next, the goal should not simply be adopting more AI. It should be making sure AI is being integrated into the business with the same visibility, governance and accountability expected across the rest of the federal contracting environment.
GovContractPros will continue monitoring federal AI policy, cybersecurity requirements and acquisition developments affecting the government contracting community.
