CMMC Is Expanding Into AI — And Most Contractors Don’t Know It Yet

For the past several years, defense contractors have watched CMMC roll out in stages: draft rule, final rule, phased implementation, assessments. Many companies are still catching up. Now, a new requirement is quietly being built into the same framework, and it centers on artificial intelligence.

Buried inside the Fiscal Year 2026 National Defense Authorization Act (NDAA), signed into law on December 18, 2025, is a provision that will fundamentally change how AI tools are treated under defense cybersecurity compliance. Section 1513 directs the Department of Defense to build a risk-based cybersecurity and physical security framework specifically for AI and machine learning systems the Pentagon acquires. Once that framework is finalized, it doesn’t sit off to the side as a separate program; the law directs DoD to fold it directly into the Defense Federal Acquisition Regulation Supplement (DFARS) and into CMMC itself, so that any contractor developing, deploying, storing, or hosting AI/ML for the DoD has to comply with it.

In other words: AI is becoming part of your CMMC scope, not a separate track you can address later.

What Section 1513 Actually Requires

The framework directed by Section 1513 will cover a wide range of AI-specific risks, including workforce risks, supply chain risks, adversarial tampering, data theft, and ongoing security monitoring for AI systems. It’s meant to build on, not replace, the cybersecurity structure contractors already know, drawing on the NIST SP 800 series and layering onto CMMC rather than creating a brand-new certification regime. Systems considered highest-value targets for cyber threat actors will face stricter security requirements, similar to protections already used for national security systems.

The law doesn’t set a hard deadline for finalizing the framework, but it does require DoD to build an implementation plan with timelines and milestones and to report that status to Congress. That report was due by mid-June 2026, which means the machinery is already moving. The public simply hasn’t been watching closely, because this provision was one of hundreds tucked inside a nearly trillion-dollar bill.

Why This Matters Even If You Don’t “Do AI”

This is the point most contractors miss. You don’t have to be an AI company, or sell an AI product to the government, for this to apply to you. If your engineers use AI coding assistants, if your manufacturing or robotics processes incorporate AI-driven tools, or if your teams use generative AI in day-to-day work that touches federal contract information (FCI) or controlled unclassified information (CUI), that usage is moving into scope.

Historically, a lot of AI use inside defense manufacturers and shipyards has functioned like shadow IT: employees use tools like ChatGPT or Claude on their own initiative, get real productivity gains, but never formally declare that use as part of the company’s compliance boundary. That gap is closing. Prime contractors have already started asking subcontractors how they’re using AI, and that pressure will only increase as the DoD framework takes shape and prime-to-sub flow-down requirements follow the usual CMMC pattern.

There’s also a foreign-influence dimension to watch. Federal policy has increasingly restricted or banned the use of AI tools tied to foreign adversary nations on DoD-related work, alongside broader efforts to keep sensitive data and AI supply chains under U.S. control. Contractors need to know exactly which AI tools their people are using, where those tools are built, and where the data goes, because an audit that turns up a prohibited tool doesn’t get a pass; it becomes a failed assessment.

The CMMC Parallel Is Not a Coincidence

CMMC took years to go from a line item in the FY2020 NDAA to a fully enforced program, and a large share of the defense industrial base was caught unprepared when it did. Right now, industry estimates suggest only a small fraction of defense contractors (roughly one to two percent) have actually completed CMMC certification, even though the requirement has been on the horizon for years.

The AI framework directed by Section 1513 is following the exact same arc: legislative mandate first, agency framework development next, then incorporation into the acquisition and certification structure everyone already deals with. The contractors who treat this as background noise today are the ones who will be scrambling when it lands inside a CMMC assessment, likely as part of a future NIST SP 800-171 revision, whether that’s a 3.5 update or a full Revision 4. Given CMMC’s three-year reassessment cycle, contractors currently going through certification should expect AI-specific requirements to be part of the picture well before their next audit comes around.

The Business Decision Isn’t “Whether” — It’s “How”

None of this means contractors should avoid AI. Turning it off isn’t a realistic strategy, and it isn’t the right one either; the productivity and cost benefits are real, and using AI well is increasingly what “resourceful” looks like on a team. The better move is treating AI adoption as a governed business decision from the start: know which tools your people are using, put a business account and clear usage policy behind it instead of leaving it to individual employees on personal accounts, understand where your data goes, and build the security posture around it before a regulator asks you to.

Companies that expect to lean on AI for engineering, coding, or manufacturing processes going forward are also increasingly looking at private or proprietary AI environments, so sensitive data trains their own systems rather than feeding into public models they don’t control. That’s a heavier lift than a consumer AI subscription, but for mid-size and larger contractors handling CUI, it’s becoming a serious part of the conversation.

Getting Out Ahead of It

At Valor Cyber Security, we work with defense manufacturers and shipbuilders every day on exactly this kind of question: how to use AI in a way that saves time and money without creating compliance exposure down the line. As Valor CEO Greg Tomchick put it in a recent briefing to clients, the goal isn’t to scare people away from AI; it’s to make sure the decision to use it is a deliberate, secured, documented one, so that when these requirements formally arrive, the business isn’t rebuilding its program from scratch.

That’s the real lesson from the original CMMC rollout, and it’s the one worth applying now, while the AI framework is still being written rather than already being enforced. The question isn’t whether AI is going to become part of CMMC. Section 1513 already answers that. The real question is whether your compliance program is designed to absorb that change when it lands or whether you’ll be starting over.

To hear more about this topic from Greg Tomchick, CEO of Valor Cybersecurity, catch the discussion here. https://www.youtube.com/watch?v=no_bpBoQ59I

Valor Cyber Security works exclusively with defense manufacturers and shipbuilders in the defense industrial base on CMMC compliance and cybersecurity strategy. To discuss how the FY2026 NDAA’s AI provisions may affect your compliance scope, schedule a free 15-minute consultation at valorcybersecurity.com.