Defense AI: Can We Use It for CUI or ITAR Data?

CUI: Yes, on all supported deployment types. Defense AI deploys into your own account on FedRAMP-authorized US cloud services. Defense AI itself is not a FedRAMP-authorized product.

ITAR / export-controlled data: Only on GCC High (Azure Government), and only with Azure Government models. Azure Commercial and the Google Cloud Claude add-on are for CUI only, not ITAR. Claude models aren't supported for ITAR on any deployment type, including GCC High.

Atomus doesn't make an ITAR or export-control determination for your company. Your empowered official or export-compliance lead decides what data your company may process and where.

Quick reference

Your company is responsible for training people and setting model access so that ITAR data isn't sent to Claude models.

Why GCC High is the ITAR option

Azure Government is a separate cloud for US government work. Microsoft commits that customer data stays in the US and that access to the systems is limited to screened US persons. Those commitments are what export-controlled work usually needs, beyond a FedRAMP authorization. Azure Commercial and Google Cloud's Claude offering don't carry the same commitments, so Defense AI limits them to CUI.

What "approved for CUI" covers

It covers traffic between your tools, your gateway and your models. It doesn't cover everything around them. You still need to:

• Use managed devices in your CMMC scope. Prompts, responses, chat history and files live on the computer running the tool. That computer has to be one your company has brought into scope for CUI. A development laptop outside your CMMC enclave shouldn't be used for CUI work, even with Defense AI.

• Use only approved connectors. See Defense AI: Microsoft 365 and Third-Party Connectors.

• Use the Defense AI profile. A personal or commercial Claude or ChatGPT account isn't part of Defense AI. In Claude Desktop, check that the bottom-left corner says Defense AI.

• Handle outputs as CUI when they contain CUI.

• Update your System Security Plan to describe Defense AI and how you use it.

Does Defense AI make us CMMC compliant?

No single tool does that. Defense AI is designed to fit inside a CMMC Level 2 environment. Your assessment still covers your own policies, devices, people and how you use the tool. Talk to your Atomus contact about how to document Defense AI in your SSP.

Will every future model be approved for ITAR?

Not necessarily. New models can arrive on one cloud before another. Check with your Atomus contact before using a new model for export-controlled work.

Can we keep commercial AI for non-CUI work?

Yes, if your policy allows it. Defense AI doesn't stop you from using other AI tools for work that isn't CUI. Make sure people know which tool is for which work.

Related articles: Defense AI: Where Your Data Is Processed (US Data Centers and FedRAMP) · Defense AI: Data Retention, Who Sees Our Data, Is it Used for Training · Defense AI: Using CUI Documents for Proposals and Reports · Defense AI: Using AI Coding Agents: Files, Secrets and Repository Content