CMMC Phase 2 is paused. What does that change about using AI on CUI?

The pause produces two bad conclusions in the same meeting: "CMMC is off, so the AI pilot can go ahead," and "everything is in flux, so nothing can." Both come from reading the headline and not the memo. Here is what the memo, the regulation and the enforcement record say as of October 16, 2026.

The pause removed an assessor, not a requirement

On July 13, 2026 the Department of War suspended the move to CMMC Phase 2, which had been scheduled for November 10, 2026, and put the later milestones in abeyance until further notice. Phase 2 would have made a Level 2 assessment by a certified third-party assessment organization (a C3PAO) a condition of award for many contracts involving CUI. During the suspension, program offices may include only Level 1 (Self) or Level 2 (Self) requirements; C3PAO and DIBCAC requirements come out of solicitations by amendment and out of existing contracts at the next option exercise or administrative modification, and the CMMC waiver process is suspended too (Morgan Lewis, July 16, 2026; Sheppard Mullin, July 14, 2026). Class Deviation 2026-O0025, revised on September 3, 2026, carries the pause into contract text.

The suspension memo also directed the Department to "continue to enforce baseline cybersecurity compliance," naming NIST SP 800-171 Rev 2, self-assessments, select government-led assessments and DFARS 252.204-7012 (Sheppard Mullin, above). The Department's chief information officer put it more bluntly the day it was announced: "We are not reducing cybersecurity through this measure" (DefenseScoop, July 13, 2026).

So the structure looks like this. Four layers were set to stand between a contractor and a CUI contract. The pause touched one of them.

The rules that decide an AI question are all still in force

Start with the contract clause. DFARS 252.204-7012, still the May 2024 version and unchanged by the February 2026 DFARS overhaul, says that if a contractor uses an external cloud service to store, process or transmit covered defense information, the provider must meet "security requirements equivalent to those established by the Government" for the FedRAMP Moderate baseline, and must comply with paragraphs (c) through (g) of the clause: incident reporting within 72 hours of discovery, malicious software handling, media preservation, forensic access and damage assessment support (DFARS 252.204-7012 at acquisition.gov). An AI service that reads a CUI document is a cloud service processing covered defense information. The pause did not amend a word of this.

Now the CMMC rule itself, which is still on the books at 32 CFR Part 170 even though its Phase 2 is suspended. Its scoping section, 32 CFR 170.19, says that before performing "a Level 2 self-assessment or Level 2 certification assessment" the contractor must consider whether each external service provider is a cloud service provider and whether it processes, stores or transmits CUI. For a cloud provider that does, the rule's table states: "The CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012." The provider's use must also be documented in the System Security Plan and in the provider's customer responsibility matrix. Note the wording: the scoping rule applies to a self-assessment in the same terms as to a certification assessment. Moving from Level 2 (C3PAO) to Level 2 (Self) does not move an AI service out of scope.

Underneath both sits NIST SP 800-171 Rev 2, whose requirement 3.1.20 asks you to "verify and control/limit connections to and use of external systems," with cloud services, including software as a service, named in the discussion as external systems you may put terms on or restrict your people from using. A chatbot in a browser tab is an external system under that requirement whether or not anyone has written it down.

Put the three together and an AI tool that could see CUI lands in one of three places: it meets the 7012 cloud bar and is written into your System Security Plan, it is kept out of reach of CUI by design with the controls that prove it, or it is a gap. The pause changed none of the three. The same sorting exercise applies here that applies to putting CUI into ChatGPT or Copilot: classify the document first, name the product second, check the boundary last.

What did change: your signature now stands where the assessor stood

Here is the part of the pause that deserves more attention than it has had. Under 32 CFR 170.22, a senior-level Affirming Official from each organization enters an affirmation in SPRS at the completion of a self-assessment and annually after that, stating that the organization has implemented and will maintain all applicable requirements across the assessment scope. Until July, a Level 2 contractor on a CUI contract was preparing for a C3PAO to walk its boundary, starting November 10, 2026. Now the affirmation is the check.

That is a statement to the government, and the enforcement record shows what a wrong one costs. On September 1, 2026 the Department of Justice announced that Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that from April 2020 through December 2023 a Honeywell business unit "submitted false claims for payment by failing to comply with cybersecurity requirements specified in" NIST SP 800-171 "with respect to one of Honeywell's networks," with the former employee who filed the case receiving $375,823 (Department of Justice; the claims are allegations only, with no determination of liability). The conduct predates CMMC Phase 1 entirely; the government needed only the contract, the standard and a whistleblower. Latham & Watkins' reading of the pause makes the point plainly: "A false affirmation or overstatement in those affirmations may expose contractors to significant FCA liability" (Latham & Watkins, July 30, 2026).

For AI specifically: with a C3PAO scheduled, an undocumented AI tool tends to surface in scoping interviews, early enough to fix. Without one, it surfaces never, in a government-led assessment, or in a complaint from someone inside the company who knew. The affirming official signs for all of it, including the proposal writer's personal chatbot subscription and the extension that quietly summarizes meeting recordings. The pause did not make unmanaged AI use safer. It removed the outside check that would have found it.

What changed and what did not, in one table

Item	Before July 13, 2026	Now (as of October 16, 2026)
Who may assess Level 2 for a new award	Self under Phase 1; C3PAO certification was to be required from November 10, 2026 under Phase 2	Level 1 (Self) or Level 2 (Self) only, per the implementation memo; C3PAO and DIBCAC requirements removed from solicitations and at the next contract modification
NIST SP 800-171 Rev 2	Required by DFARS 252.204-7012	Unchanged; named in the suspension memo as the baseline to keep enforcing
DFARS 252.204-7012 cloud requirement	FedRAMP Moderate equivalent plus paragraphs (c) through (g)	Unchanged
Scoping of cloud AI services under 32 CFR 170.19	CSP handling CUI must meet the 7012 FedRAMP requirements; documented in the SSP	Unchanged; applies to self-assessments in the same words
Annual affirmation in SPRS under 32 CFR 170.22	Required	Required, and now the main verification mechanism
False Claims Act exposure for a wrong affirmation	Real (Civil Cyber-Fraud Initiative)	Real; the Honeywell settlement landed seven weeks after the pause
CMMC waivers	Case-by-case process	Suspended during the review
Future of third-party assessment	Phases 2 through 4, one year apart	Under review by the CMMC Reform Task Force; report unpublished

What the Reform Task Force might change, and what it cannot

The suspension memo stood up a CMMC Reform Task Force for a 60-day review, with a request for information that closed on August 14, 2026. The Department's CIO said in September that it drew more than 1,100 responses and more than 10,000 pages, that department meetings on the subject drew more than 3,000 attendees, and that more than half of respondents favored putting the program on hold. She also described the direction she wants: away from point-in-time assessment. "Compliance equals compliance. Compliance doesn't equal security." How contractors will prove compliance under whatever replaces it, she acknowledged, is not yet resolved (DefenseScoop, September 9, 2026). As of October 16, 2026 the task force report has not been published.

The task force can reshape how the Department verifies compliance, and Morgan Lewis notes that third-party requirements "could return in modified form." It cannot quickly change the things that decide an AI question: DFARS 252.204-7012 is a contract clause that lives outside the CMMC rule, and NIST SP 800-171 is the standard that 32 CFR 2002 points every non-federal system holding CUI toward. A separate proposed FAR rule published June 23, 2026 would apply CUI safeguarding government-wide, not just at DoD, and require Rev 3; it is not final. None of the plausible outcomes makes a commercial chatbot an acceptable place for CUI.

And if the Department does move toward continuous evidence rather than a triennial visit, the contractors in the best position will be the ones whose AI use already produces a record: which user asked what, from which source, through which approved tool. That is the same discipline that keeps AI on Costpoint data audit-ready, applied to a different auditor.

What to do with an AI project this quarter

Do not wait for the report. Classify first: most Costpoint finance data (indirect rates, payroll, billing) is sensitive business data but usually not CUI, while technical data, deliverables and some contract documents may be. Put CUI workflows only in environments that meet the 7012 bar for the specific service, not just the cloud it runs in: FedRAMP authorized AI services in AWS GovCloud or Azure Government, a Microsoft 365 GCC High tenant inside your assessment scope, or on-premises models you control. Keep everything else on enterprise terms with no-training and retention commitments in the signed agreement. Log the user, the prompt and the source of every approved AI interaction. Then do the one thing the pause makes newly urgent: write every AI service into the System Security Plan and the customer responsibility matrix, as 32 CFR 170.19 already requires, and brief the affirming official on exactly what they are signing before the next annual affirmation.

None of that is harder than it was in June. It is simply no longer anyone else's job to notice if it was skipped.

Common questions

Does the CMMC pause mean we can use ChatGPT Enterprise or Copilot on CUI now?

Not on the strength of the pause. The suspension changed which assessments a contracting officer may require. It did not change DFARS 252.204-7012, which requires any external cloud service handling covered defense information to meet FedRAMP Moderate equivalent requirements and accept the clause's incident reporting and forensic paragraphs, and it did not change NIST SP 800-171. Whether a specific product qualifies is the same contract and authorizing-official question it was before July 13, 2026.

We hold a Level 2 (Self) status. Do we still have to affirm every year?

Yes. Under 32 CFR 170.22 a senior-level Affirming Official enters an affirmation in SPRS at the completion of the self-assessment and annually after that, stating that the organization has implemented and will maintain all applicable requirements across the assessment scope. The July 2026 memo directed the Department to keep enforcing baseline compliance through self-assessments, so the affirmation is now the main check.

Will third-party CMMC assessments come back?

Nobody outside the Department knows yet. The CMMC Reform Task Force ran a 60-day review with more than 1,100 responses to its request for information, and the Department's CIO has said she wants to move away from point-in-time assessments. As of October 16, 2026 the task force report has not been published. Morgan Lewis notes that third-party requirements could return in modified form, which is a reason to keep AI tools documented as if an assessor were coming.

Are our Costpoint financials CUI for purposes of this question?

Usually not. CUI is information the government creates or possesses, or a contractor creates for it, that a law, regulation or government-wide policy requires an agency to safeguard, and the designating agency marks it. Indirect rates, payroll and billing data are sensitive business data and deserve enterprise terms, but they are generally not CUI. Technical data, deliverables and some contract documents may be, so classify the documents before choosing tools.