CUI Safe AI

CUI questions

Which AI tools can I use in a CMMC Level 2 environment?

Short answer

We rank by authorization, not features. 17 AI offerings we track have a "Yes, with conditions" CUI answer today, across Chat assistant, Coding agent, Enterprise search and assistant, Meeting notetaker, Model API and Productivity suite AI.

By category: Chat assistant: Claude for Government, Ask Sage, Gemini for Government and ChatGPT Enterprise and API Platform for FedRAMP. Coding agent: Kiro (AI coding IDE) in AWS GovCloud and Codex (desktop app and CLI) signed in to a FedRAMP workspace. Enterprise search and assistant: Amazon Q Business and Moveworks GovCloud. Meeting notetaker: Zoom AI Companion for Zoom for Government. Model API: Claude in Amazon Bedrock (AWS GovCloud), Claude on Vertex AI with Assured Workloads, Generative AI on Gemini Enterprise Agent Platform (formerly Vertex AI), Assured Workloads, Azure OpenAI in Azure Government, OpenAI models in Amazon Bedrock (AWS GovCloud) and Grok models in Amazon Bedrock (AWS GovCloud). Productivity suite AI: Microsoft 365 Copilot in GCC High and Microsoft 365 Copilot in DoD environment.

Every one of them has conditions, such as a separate government workspace, a specific region, or customer-managed keys. Read the conditions on each tool page before you add it to your SSP.

Generated from our dataset. Sources last re-checked Oct 17, 2026.

CMMC Level 2 security requirements are identical to NIST SP 800-171 Rev 2 (32 CFR 170.14). For any cloud service that stores, processes or transmits covered defense information, DFARS 252.204-7012 requires FedRAMP Moderate equivalent security and compliance with paragraphs (c) through (g) (acquisition.gov). An AI tool that sees CUI is part of that picture, so it belongs in your SSP and boundary diagram.

The sourced table

AI offeringFedRAMPDoD ILCan I use it with CUI?Source
Claude for GovernmentAnthropic · Chat assistantAuthorizedHighIL5 not included (per Anthropic)Yes, with conditionsfedramp.govchecked Oct 17, 2026
Ask SageAsk Sage · Chat assistantAuthorizedHighIL5 (per vendor)Yes, with conditionsfedramp.govchecked Oct 17, 2026
Gemini for GovernmentGoogle · Chat assistantAuthorizedLow (Marketplace) / High via Assured Workloads (Google)IL4 (with exceptions)Yes, with conditionsfedramp.govchecked Oct 17, 2026
ChatGPT Enterprise and API Platform for FedRAMPOpenAI · Chat assistantAuthorizedModerateNot establishedYes, with conditionsfedramp.govchecked Oct 17, 2026
Kiro (AI coding IDE) in AWS GovCloudAWS · Coding agentAuthorizedHighIL2, IL4, IL5 (GovCloud)Yes, with conditionsaws.amazon.comchecked Oct 17, 2026
Codex (desktop app and CLI) signed in to a FedRAMP workspaceOpenAI · Coding agentAuthorizedModerateNot establishedYes, with conditionsfedramp.govchecked Oct 17, 2026
Amazon Q BusinessAWS · Enterprise search and assistantAuthorizedModerateIL2 (East/West) onlyYes, with conditionsaws.amazon.comchecked Oct 17, 2026
Moveworks GovCloudMoveworks · Enterprise search and assistantAuthorizedModerateNot establishedYes, with conditionsfedramp.govchecked Oct 17, 2026
Zoom AI Companion for Zoom for GovernmentZoom · Meeting notetakerAuthorizedModerateNot establishedYes, with conditionsfedramp.govchecked Oct 17, 2026
Claude in Amazon Bedrock (AWS GovCloud)Anthropic via AWS · Model APIAuthorizedHighUnclear (sources disagree)Yes, with conditionsaws.amazon.comchecked Oct 17, 2026
Claude on Vertex AI with Assured WorkloadsAnthropic via Google Cloud · Model APIAuthorizedHighIL5 not included (per Anthropic)Yes, with conditionsfedramp.govchecked Oct 17, 2026
Generative AI on Gemini Enterprise Agent Platform (formerly Vertex AI), Assured WorkloadsGoogle · Model APIAuthorizedHighIL4Yes, with conditionsfedramp.govchecked Oct 17, 2026
Azure OpenAI in Azure GovernmentMicrosoft · Model APIAuthorizedHighIL2, IL4, IL5 (IL5 needs customer-managed keys)Yes, with conditionsfedramp.govchecked Oct 17, 2026
OpenAI models in Amazon Bedrock (AWS GovCloud)OpenAI via AWS · Model APIAuthorizedHighIL4/IL5 for listed modelsYes, with conditionsaws.amazon.comchecked Oct 17, 2026
Grok models in Amazon Bedrock (AWS GovCloud)xAI via AWS · Model APIAuthorizedHighIL4/IL5 for listed modelsYes, with conditionsaws.amazon.comchecked Oct 17, 2026
Microsoft 365 Copilot in GCC HighMicrosoft · Productivity suite AIAuthorizedHighNot stated for CopilotYes, with conditionsfedramp.govchecked Oct 17, 2026
Microsoft 365 Copilot in DoD environmentMicrosoft · Productivity suite AIUnclearNot separately listedIL5 (environment)Yes, with conditionslearn.microsoft.comchecked Oct 17, 2026

Every row links to its primary source and full page. Statuses change; open the source before you decide. How we verify.

Related questions

Is ChatGPT CMMC compliant?

No product is "CMMC compliant" on its own; your organization is assessed. For the cloud tool, the question is whether it meets the DFARS Moderate baseline. The standard commercial ChatGPT plans are not the FedRAMP offering. OpenAI says existing Enterprise workspaces cannot be converted to FedRAMP, so CUI work needs the separate FedRAMP workspace.

Is Microsoft Copilot CMMC compliant?

Same caveat. Microsoft says GCC High is the environment for organizations handling CUI or needing FedRAMP High, DFARS or ITAR, and that Copilot prompts and responses stay in the government tenant.

Is Claude CMMC compliant?

Same caveat. Anthropic says Claude Enterprise is not FedRAMP authorized today. See the Claude page for the Department of War supply chain designation.

Can I use AI notetakers in CMMC meetings?

Zoom lists AI Companion for Zoom for Government among the products in its FedRAMP Moderate environment. Use the Zoom for Government platform, not commercial Zoom. Otter.ai has no FedRAMP Marketplace listing and we found no government environment.

Not legal advice. These answers describe what public authorization records and vendor documentation say, not whether your contract, data or configuration is compliant. Confirm with your contracting officer, assessor or counsel.

More questions

All questions