The problem with 'just use AI'
For a defense contractor, every AI capability is also a data-flow decision. If a retrieval pipeline indexes your file shares, it indexes your CUI. A model endpoint outside the boundary becomes an uncontrolled egress path, and an assessor won't accept answers with no traceability. The opportunity is real, but the AI has to be engineered inside the compliance perimeter.
What we build
- CUI-safe RAG architectures keep retrieval and generation pipelines inside the CUI boundary, with Purview labeling and DLP enforced at every hop.
- Auditable, explainable models come with logging, access control, and decision traceability, packaged as evidence artifacts an assessor can test.
- Native GCC High and Azure Government deployment keeps the workload inside the federal cloud, with no commercial endpoints in the path.
- Design-time risk work deals with data-leakage paths, model export-control exposure under ITAR/EAR, and compliance drift before an assessment can find them.
- Integration with your existing stack extends Purview, Defender, Intune, and WDAC to the AI workload, so one control implementation still covers the whole environment.
Questions contractors ask us
Can we use AI on CUI at all?
Yes, if the entire pipeline stays inside your CUI boundary and satisfies the same controls as any other system that processes CUI. You cannot paste CUI into a commercial AI endpoint outside the boundary. In a compliant setup, the model, the retrieval layer, and the logs all live where your assessment can see them.
What does 'auditable AI' actually mean?
It means logging, access control, and decision traceability packaged as evidence artifacts an assessor can test: who queried what, which documents fed which answer, and which controls governed access. If you can't produce that trail, expect the AI system to become an assessment finding.
Does ITAR apply to AI models?
It can. A model trained on export-controlled technical data can itself embody controlled technology, and model weights or outputs can constitute an export if foreign persons can reach them. We deal with that risk at design time through deployment location, access control, and training-data governance, before an audit finds it.
Scope an AI project that survives an assessor.
Tell us the use case, such as document intelligence, proposal support, or engineering search, and we'll map it to a boundary-safe architecture. Or email rj@indirectit.com directly.