Consus Blog

How to Use Generative AI Without Violating CMMC

October 20, 2026 · Eric Magliarditi

Generative AI is now part of how defense contractors write proposals, review contracts, triage support tickets, and speed up engineering work. It is also one of the easiest ways to put Controlled Unclassified Information (CUI) somewhere it was never authorized to go. A single pasted paragraph, a file dropped into a chat window, or a coding assistant reading a repository with a customer's technical data in it can turn a productivity tool into a CMMC finding.

The good news is that this is a solvable problem, and solving it does not mean banning AI or building a compliance program from scratch. Consus Gateway lets defense contractors use frontier models, including Claude, GPT, Gemini, and Grok, without the CUI in their prompts ever leaving a government-authorized boundary. This guide covers what CMMC actually requires of an AI workflow, where contractors get into trouble, and why Consus is the fastest way to close the specific gaps that cause violations.

Why generative AI creates CMMC risk

CMMC Level 2 requires all 110 practices in NIST SP 800-171. None of them were written with chatbots in mind, but the obligation does not go away because the tool is new. Any system that processes, stores, or transmits CUI falls inside your assessment boundary, and a generative AI tool joins it the moment someone pastes contract-sensitive text into it.

The risk shows up in a few predictable ways:

• Public AI tools. A consumer chatbot has no government-cloud authorization, no contractual data-handling guarantee for CUI, and often no assurance that a prompt won't be retained or used for training. Sending CUI there is a straightforward violation, whatever the tool's marketing says about security.
• Compliant-sounding commercial endpoints. An OpenAI-compatible API with a US address is not a FedRAMP High or DoD IL5 authorized environment. API compatibility is an integration detail, not a compliance credential.
• Shadow AI. Engineers and analysts adopt AI tools faster than security teams can review them. Without an enforced routing layer, a well-meaning engineer can send CUI to an unapproved model, and no one finds out until an assessment or an incident surfaces it.
• Silent scope creep. Even an approved integration can drift. A new plugin, a retrieval system that pulls in controlled documents, or a model version change can quietly move a compliant workflow outside its authorized boundary.

None of these are reasons to avoid generative AI. They are reasons to control where it is allowed to go, which is exactly the problem Consus was built to solve.

The three things a compliant AI workflow needs

Whatever tool you pick, three things have to be true before CUI reaches a model:

1. The request goes to an authorized environment. That means FedRAMP High, the right DoD Impact Level, and an ITAR-authorized path where export-controlled data is involved. Not a general commercial region.
2. The path in between is controlled. Identity, encryption, retention, and logging are enforced consistently, not left to whichever application happens to be calling the model that day.
3. You have evidence. An assessor does not take a vendor's word for it. They need documented architecture, data flows, and control mappings that you can fold into your own SSP and POA&M.

Consus is built around exactly this shape, and each piece maps to a documented product capability rather than a general claim.

1. An authorized environment, enforced by the model ID

Consus routes every request to one of three government clouds: AWS GovCloud, GCP Assured Workloads, or Azure Government. There is no configuration path to a commercial region. It is not a setting you have to remember to lock down. It is the only way Consus operates.

The compliance level is part of the request itself. Every model ID carries a suffix such as :fedramp-high, :il4, :il5, :itar, or a combination like :il5+itar. A request with no suffix is rejected with a 400 error before it reaches any model, so an engineer cannot accidentally send a request to an unspecified tier. Higher levels satisfy lower ones within the same framework: a model authorized at IL5 can also be requested at IL4 or IL2, and a FedRAMP High model at Moderate or Low. Never the reverse.

Across those three clouds, Consus offers more than 20 models from Anthropic, OpenAI, Google, and SpaceXAI, each with a documented authorization ceiling. Picking a model is a lookup, not a guess: the model catalog filters by compliance level and ITAR status.

2. A controlled path, not just a controlled destination

Reaching the right cloud is necessary but not sufficient. The path matters too, and Consus covers the parts of it you would otherwise build and secure yourself:

• Zero persistence. Prompts and responses exist only in memory while a request is in flight. They are never written to disk, logged, or stored, and every model provider on every route is configured for zero data retention. This is the biggest reduction in assessment scope Consus gives you: there is no gateway-side content store to diagram, secure, or defend.
• No long-lived cloud credentials. Consus reaches GCP and Azure through Workload Identity Federation, exchanging short-lived tokens instead of storing static keys, so there is no long-lived cloud credential at rest for an attacker to find.
• Encryption and network isolation. TLS 1.2 or higher on every connection, FIPS 140-2 validated endpoints by default, and a distinct encryption key for each cloud boundary. The gateway runs in private subnets with no direct internet access.
• Agent guardrails. Generative AI increasingly means agentic AI: models that call tools, browse, or run code. Consus blocks hosted tools like web search and code execution, because they would move data outside the compliance boundary. It also inspects every tool definition in a request and rejects any that describe an outbound destination, such as a webhook or callback URL, so a coding assistant or agent framework cannot become an accidental exfiltration path.
• Fail closed. An unauthorized model, a missing compliance level, or a rejected tool definition stops the request. Consus never silently reroutes to a lower authorization level to keep things working.

For your compliance team, the hardest parts of a secure AI integration (identity, encryption, network isolation, and agent guardrails) arrive already built and already documented, instead of becoming a months-long infrastructure project.

3. Evidence an assessor can actually use

DFARS 252.204-7012 requires any cloud that handles your CUI to meet the FedRAMP Moderate baseline or its equivalent, and your assessor will check. Consus is FedRAMP Equivalent, assessed at High: our 3PAO tested Consus against all 410 FedRAMP High controls. Enterprise customers get the Body of Evidence that comes with it, including the 3PAO assessment report, SSP inputs, a control mapping workbook, and the POA&M, so the AI-gateway portion of your SSP starts from documentation instead of a blank page.

It also helps to keep the frameworks straight. CMMC, FedRAMP, DoD Impact Levels, and ITAR are four different obligations, and contractors often conflate them when they evaluate AI vendors on marketing claims instead of the specific authorization that applies to their workload.

The logging behind that evidence is deliberately narrow. Consus keeps operational metadata only (API key ID, model, token counts, and latency) and never prompt or response content. AWS access and application logs and Azure diagnostic logs are retained for 365 days, GCP audit logs carry a three-year retention lock, and all of it is KMS-encrypted. That gives your assessor what they want to see: who used an approved route, which model, and whether policy enforcement worked. It does not create a second, unmanaged store of sensitive conversations for you to secure and account for.

What Consus doesn't do, on purpose

A compliant AI program is a shared-responsibility model, and Consus draws that line clearly instead of blurring it to look more complete. The customer responsibility guide spells it out:

• Consus does not classify content. It does not scan prompts for CUI, detect markings, or decide whether a document is sensitive. That decision belongs to your applications and data owners, because it takes mission context a routing layer does not have.
• Consus does not stop a user from choosing the wrong compliance level. If a request is sent as :il2 when the content is IL5 CUI, Consus routes it to the IL2 environment as specified. Choosing the right level for the data is your call.
• Consus does not secure your client applications. API key handling, retrieval-system permissions, vector-store access, and local tool execution in a coding assistant are outside the gateway and remain yours to secure and document.

This is also why no product, Consus included, makes you CMMC compliant on its own. CMMC assesses your whole system and your documented controls. Consus covers the AI-gateway layer and hands you the evidence for it. A clean line between what the vendor guarantees and what your own controls guarantee is exactly what an assessor wants to see.

Putting it into practice

For a contractor rolling out generative AI under CMMC, the sequence looks like this:

1. Classify before the request leaves the application. Decide whether a prompt, attachment, or retrieval context contains CUI or export-controlled data before it goes anywhere.
2. Pick the model ID that matches the data. With Consus the compliance level is part of the request, not a background setting someone might miss.
3. Point your existing tools at Consus. Consus speaks the OpenAI-compatible API and the Anthropic Messages API, so adoption means changing the base URL, the API key, and the model ID, not rewriting the application. It works with the OpenAI SDK, LangChain, LlamaIndex, LiteLLM, Claude Code, Codex CLI, Cline, OpenCode, and VS Code Copilot.
4. Let the gateway enforce the boundary. Zero persistence, government-cloud-only routing, and tool screening are always on. There is nothing to switch on and no compliant configuration to get wrong.
5. Build your SSP from documented evidence. Fold Consus's architecture, data-flow, and control documentation into your own assessment package.

None of this takes long. Most teams send their first request the day the contract is signed. On Enterprise, your IT team pushes ready-made packages for Claude Desktop, ChatGPT, Claude Code, and Codex through Jamf, Kandji, Intune, or Group Policy, and your identity provider's groups decide which models each team can call. Rollout takes under a day.

The bottom line

CMMC does not require you to avoid generative AI. It requires you to know exactly where your data goes, prove it, and show your work. Building that yourself means standing up multi-cloud government infrastructure, identity federation, key management, and audit logging before a single engineer gets to use an AI coding assistant on a repository that touches CUI. Consus turns that infrastructure project into a configuration change, and hands your compliance team documented evidence instead of a blank page.

Request access to get started. Access is reserved for US-based defense contractors and follows a company review and contract.

Read this post as Markdown