Is it safe to put CUI or contract documents into ChatGPT or Copilot?

This question usually arrives after the fact. A contracts manager pasted a statement of work into a chatbot for a summary. A proposal writer dropped last year's technical volume into a chat window to rewrite it. Nobody meant harm, and probably nothing harmful happened. But the CFO now has to answer a harder question than "was that okay": can the company say, in writing, what is allowed and why?

Here is what the rules and the vendors' own documents say as of October 14, 2026.

ChatGPT and Copilot are each several products with different terms

Both names cover a consumer product and an enterprise product, and the two have different data terms.

The free, Plus and Pro versions of ChatGPT may use what you type to train models unless the user turns off "Improve the model for everyone" in settings. ChatGPT Business, Enterprise, Edu and the API are excluded from training by default, and Enterprise administrators control how long data is kept (OpenAI enterprise privacy, updated January 8, 2026). On April 27, 2026, OpenAI announced FedRAMP 20x Moderate authorization for ChatGPT Enterprise and the API Platform, with agency use "subject to each agency's policies and authorization decisions" (OpenAI). There is no FedRAMP High offering, and OpenAI's government page says handling CUI is "ultimately a customer and authorizing-official determination."

The consumer Copilot app, used with a personal Microsoft account, carries this instruction from Microsoft: "Never add sensitive or proprietary work information in a prompt." Copilot Chat and Microsoft 365 Copilot, used with a work account, carry what Microsoft calls enterprise data protection: prompts, responses and data reached through Microsoft Graph are not used to train foundation models, and the tool only surfaces content the user already has permission to view (Which Copilot for your organization; Microsoft 365 Copilot privacy, both updated August 2026). Microsoft also notes that customers outside the EU "may have their queries processed in the US, EU, or other regions," a detail worth reading twice if your contracts care where data sits.

So "is Copilot safe" gets a question back: which Copilot, with which account, in which tenant?

The document decides more than the tool does

CUI is information the government creates or possesses, or a contractor creates for it, that a law, regulation or government-wide policy requires or permits an agency to safeguard. The designating agency marks it, and the categories live in the National Archives CUI Registry (32 CFR Part 2002). FCI, Federal Contract Information, is the broader category of information "not intended for public release" that is provided by or generated for the government under a contract. FCI needs the 15 basic safeguards; CUI pulls in NIST SP 800-171 and, through DFARS 7012, a FedRAMP Moderate equivalent requirement for any cloud service that touches it.

For a Costpoint shop, this is where fear outruns the facts. Indirect rates, payroll, billing files and project financials are sensitive business data. They deserve enterprise terms and access controls. But they are generally not CUI. The documents likely to be CUI are the ones that came from the government or were built for it: technical data, deliverables, some statements of work and some contract documents, especially on defense work. The honest answer to "can we put contract documents into ChatGPT" is "which contract documents," and a half-day classification exercise usually settles it.

The government has drawn this line for its own staff. ISOO Notice 2026-01, issued March 30, 2026, says "it is prohibited for agency personnel to input classified information or CUI" into AI systems that are internet-enabled or not accredited for CUI. It does not bind contractors directly, but it tells you what a contracting officer will expect.

What the contract clause actually requires

DFARS 252.204-7012, still the May 2024 version and unchanged by the February 2026 DFARS overhaul, sets two tests for any external cloud service that handles covered defense information. The provider must meet "security requirements equivalent to those established by the Government" for the FedRAMP Moderate baseline, and it must comply with paragraphs (c) through (g) of the clause: incident reporting to DoD within 72 hours of discovery, malicious software handling, media preservation, forensic access and damage assessment support (DFARS 252.204-7012 at acquisition.gov, last updated September 28, 2026).

Vendors rarely mention the second test. A FedRAMP Moderate listing answers the first half; it does not mean the vendor has agreed, in your contract, to preserve affected systems and give DoD forensic access after an incident. Ask.

Underneath the clause sits NIST SP 800-171. Requirement 3.1.20 says to "verify and control/limit connections to and use of external systems," and its discussion names cloud services, including software as a service, as external systems that an organization may put terms on or restrict its people from using. A chatbot in a browser tab is an external system under that requirement, whether or not anyone wrote it down.

One more date for the policy meeting: on July 13, 2026, the Department of War suspended the move to CMMC Phase 2, so contracting officers may currently require only self-assessed Level 1 or Level 2. The suspension changed who checks your work. It did not change the 800-171 baseline or the 7012 cloud requirement, which the suspension memo directs the Department to keep enforcing.

Where each product stands today

As of October 14, 2026, from the vendors' own pages and the sources linked above:

Product	Training on your data	Government authorization	CUI
ChatGPT Free, Plus, Pro	May train unless the user opts out	None	No
ChatGPT Business, Enterprise, API	Not by default; Enterprise admins control retention	FedRAMP 20x Moderate for Enterprise and API (April 2026)	Contract and authorizing-official decision; 7012 (c) through (g) must be in the agreement
Consumer Copilot, personal account	Microsoft says never put proprietary work information in it	None	No
Copilot Chat and Microsoft 365 Copilot, commercial tenant	Not used to train foundation models	Commercial, not a government cloud	Usually no: outside the boundary most contractors document for CUI
Microsoft 365 Copilot in GCC High	Not used to train foundation models	GCC High, the environment Microsoft built for DoD CUI and ITAR; available since December 2025	Depends: the tenant must sit inside your 800-171 scope, and several features were still missing as of mid 2026

One caution on the last row. As of June 2026, Microsoft 365 Copilot in GCC High still lacked several commercial features, including the Researcher and Analyst agents, Copilot connectors and Copilot in Teams meetings, according to the running FAQ kept by Summit 7, a Microsoft government cloud specialist. Web grounding is also off by default there, which is the right default for a CUI tenant.

"They don't train on our data" is not the same as "allowed"

Most vendor language a CFO is shown answers one narrow question: will my prompts be used to improve the model. The enterprise products answer it well. It is not the compliance question. The compliance question is whether the service sits inside the boundary your System Security Plan describes, whether its people and regions match what your contracts require, whether its logs can show an assessor who asked what, and whether its contract carries the DFARS paragraphs. A no-training promise on a web page covers none of that. The same promise in a signed agreement, next to a FedRAMP package ID and the 7012 flowdown, covers a lot of it.

The same discipline reaches your ERP vendor's cloud. Deltek's guidance for its GovCon Cloud Moderate environment tells customers and consultants not to share any data with Deltek staff outside that environment. Data leaves a controlled environment only through a path somebody approved. AI tools are no exception.

The quiet problem is that people are already doing it

At most contractors the risk has the same shape, and it is not the one in the policy binder. The official position is "we don't use AI on contract data." The actual position is that a dozen people use personal ChatGPT accounts on their phones, because the work is tedious and the tool is good, and the company has no record of any of it. A policy that only says "no" does not stop that. It moves it somewhere you cannot see.

The fix is a rule with an approved path beside it. Name the products that are allowed. Say which categories may go into each, in the words your staff use ("rate schedules yes, anything with a CUI marking no"). Ban the rest by name, including browser extensions and meeting bots that quietly upload transcripts. Give people a place to report a mistake within hours, because 7012 gives you 72 to report an incident to DoD. Then give them a tool that is better than the phone in their pocket for the work they do, or the rule will lose.

What a workable setup looks like

Classify data before picking tools, and write the answer down so the next assessor and the next hire can read it. Put CUI workflows in a government cloud or on premises, inside the enclave that already meets 800-171, and keep everything else on enterprise terms with no-training and retention commitments in the contract. Route approved AI use through something that logs the user, the prompt and the source, because an assessor's first question is "show me." And make the assistant show its sources, so a controller can check an answer about a rate in seconds rather than trust it. That last point is the same one that decides whether any AI project on your own data earns trust.

None of this costs more than the pilot people were about to run anyway. It requires doing the classification step first, which is the step most pilots skip.

Common questions

Is ChatGPT Enterprise approved for CUI?

Not automatically. ChatGPT Enterprise and the OpenAI API hold FedRAMP 20x Moderate authorization as of April 2026, and OpenAI says CUI handling is a customer and authorizing-official determination. DFARS 7012 also requires the incident reporting and forensic paragraphs in the agreement, so your contract terms and your System Security Plan decide, not the product page.

Is Microsoft 365 Copilot safe for CUI?

It depends on the tenant. Microsoft 365 Copilot has been available in GCC High since December 2025, and GCC High is the environment Microsoft built for contractors handling DoD CUI and ITAR data. Copilot in a commercial tenant carries enterprise data protection but usually sits outside the boundary a contractor has documented for CUI.

Are our Costpoint reports and indirect rates CUI?

Usually not. CUI is information the government creates or possesses, or a contractor creates for it, that an agency is required to safeguard, and the agency marks it. Indirect rates, payroll and billing data are sensitive business data and deserve enterprise terms, but they are generally not CUI. Deliverables, technical data and some contract documents may be.

What should we tell employees right now?

Give them an approved tool and a plain rule: the products that are allowed, the categories of information each may take, the tools that are banned by name, and where to report a mistake within hours. A policy with no approved tool pushes the work into personal accounts where you cannot see it.