Inteldefense
CMMC Flow-Down Reaches Your AI Vendors
A CMMC Level 2 assessment covers your network. It does not cover the annotation vendor that reads your CUI, and that is the gap contracts are written on.
The certificate on the wall covers your network. The work that trains your model happens somewhere else, usually at a vendor that has never held a defense contract and has no reason to want one.
That is the gap CMMC flow-down was written for, and it is the gap most AI programs have not mapped. Not because the requirement is new. Because the requirement assumes you know where your data went, and the AI supply chain is the first supply chain most contractors cannot draw.
What the rule actually asks
The CMMC program lives in 32 CFR Part 170 and reaches contracts through the DFARS. Level 2 is the one that matters for most defense work, and it maps to the 110 security requirements in NIST SP 800-171 Revision 2 (opens in a new tab). Assessment results go into the Supplier Performance Risk System, where a contracting officer can see them.
The part people skip is 170.23, the subcontractor requirement. A prime that handles controlled unclassified information has to flow the applicable CMMC level down to subcontractors that also handle it. The clause is not advisory. It is a condition of the subcontract, and the prime is the party accountable for the flow-down being right.
Phase 1 of the rollout began on November 10, 2025, when Level 1 and Level 2 self-assessment requirements started appearing in new awards. The phase that requires third-party assessment for Level 2 was scheduled to follow a year later.
I would not build a plan around that date. Build it around the clause. The clause is in the contract whether or not a phase slips, and the obligation to know who touches your CUI does not depend on an assessment calendar.
CUI is a property of data, not a place
Traditional supply chain compliance is easier to reason about because the thing being protected is a physical part. You know where it is. You know who machined it.
AI work moves data through a chain that is mostly invisible to the contracting officer and often to the program manager. A model gets trained on operational text, which means somebody read that text and labeled it. Somebody else reviewed the labels. A third party may have run quality checks on a sample. Then the model weights come back, and the weights are a derived artifact of the data that produced them.
At no point in that chain does the data have to sit on a defense network to be exposed. It has to sit on a laptop, in a labeling platform, in a screenshot pasted into a support ticket, in a shared drive that a subcontractor's subcontractor can reach.
The common objection is that the data was anonymized. Anonymization is a data protection technique, not a classification decision. If the text still describes an operational problem, the context travels with it, and context is often the sensitive part.
The vendor problem is a business model problem
The large commercial labeling platforms are built for customers who do not ask about CMMC. Their pricing, their tooling, and their workforce are optimized for volume, speed, and a global pool of annotators who work from wherever the platform can hire them.
Asking that vendor to become CMMC compliant is asking them to build a parallel business for a market segment they have deliberately avoided. Some will. Most will not, because the defense AI market is small next to the commercial one and the certification cost is not.
So the contractor faces a choice most programs defer too long. Build an in-house labeling capability inside an accredited environment, pay a premium to a boutique vendor that already operates there, or restructure the work so CUI never reaches the labeler.
The third option is underrated. A lot of labeling tasks can be done on synthetic or sanitized excerpts if the model is being trained for a general capability rather than a specific operation. Deciding that up front is a design choice. Discovering it after the subcontract is signed is a recompete.
Where this shows up in an evaluation
A protest is the wrong instrument for this problem, which is why you should not wait for one to clarify the rule. By the time an award is challenged, the flow-down question was settled in the contract and in the proposal. The Government Accountability Office reviews whether the agency evaluated offers according to the solicitation and the regulations. It is not going to audit your supply chain for you.
The enforcement that matters is quieter. An agency asks for your subcontractor list and their assessment status. A contracting officer compares your SPRS entry to the scope of work. A prime asks you, as a sub, for evidence you do not have.
Those moments do not produce headlines. They produce lost teaming opportunities and a proposal that never gets past compliance review.
The requirement is not that your subcontractor is certified. It is that you can prove which parts of the work they touch.
What to do before the next proposal
Draw the data path for every AI workload, including the ones that are not called AI. Where the data is collected, where it is stored, who reads it, where the labels are made, where the model is trained, where the weights go.
Mark the boundary. For each step, note whether CUI is present and under which clause it is permitted to be there. If you cannot name the clause, the step is unclassified by assumption, and assumptions do not survive an assessment.
Write the flow-down into the subcontract, not the statement of work. The statement of work describes what the vendor does. The subcontract clause describes what the vendor must be. Include the notification requirement for changes in ownership or sub-tier vendors, because that is how supply chains actually break.
Keep the evidence you would want to receive. If your own file would not satisfy you as a prime, it will not satisfy the prime you are working for.
The CMMC program is being implemented in phases because the department knows the industrial base cannot absorb it at once. That is a concession to reality, not a signal that the requirement is soft.
The contractors who treat flow-down as a paperwork exercise will be fine until the first program office asks a specific question about a specific vendor. The ones who mapped their AI data path early will answer it in an afternoon and get back to work.
The certificate proves you can be trusted with the data. The flow-down proves you know where it went. Only one of those is hard.