CMMC for AI Is Already in the Law

September 10, 2026·8 min read

Most people I talk to in the defense space still file “CMMC for AI” under future problems, something that will arrive once the Pentagon finishes its current CMMC reform and gets around to artificial intelligence. That is backwards, because Congress already wrote it. The Fiscal Year 2026 National Defense Authorization Act, signed as Public Law 119-60, has two short provisions that order the Department of Defense to build a cybersecurity and physical security framework for AI and machine learning, then fold it into the Defense Federal Acquisition Regulation Supplement and the CMMC program. The statute is done. What it commands, a framework and a DFARS clause, is future rulemaking, and the statute by itself creates no contractor obligation.

Two sections, one framework

Section 1512 is the internal half. Public Law 119-60 directs DoD, in coordination with other agencies, to establish a comprehensive cybersecurity and governance policy for every AI and ML system used inside the Department, implemented as an extension or augmentation of the cybersecurity frameworks DoD already runs. The Congressional Research Service’s summary of the NDAA spells out the risks that policy has to address: counterfeit parts, data poisoning, jailbreaks, and unauthorized access.

Section 1513 is the external half, and it is the one contractors should care about. It directs DoD to develop physical and cybersecurity procurement requirements for “covered” AI and ML systems, then incorporate that framework into the DFARS and into CMMC. Crowell & Moring’s client alert on the section spells out the reach. “Covered” AI/ML means anything DoD acquires plus all associated components: source code, model weights, and the methods, algorithms, data, and software used to develop it. “Covered entities” are the companies contracting with DoD to develop, deploy, store, or host that AI/ML. A defense contractor that builds an agent, hosts one, or stores the model behind one lands inside that definition.

The framework will be informed by the NIST SP 800 series, and Crowell’s read is that it will focus on the most capable systems, the ones threat actors would actually bother to steal or poison, with requirements aligned to how national security systems are protected. Their sharper point is that the contracting provisions will likely set de facto industry standards that reach past the defense sector, the same way CMMC did.

Section 1513 gives DoD no hard implementation deadline. It orders a plan with timelines and milestones, and a status update to Congress by June 16, 2026. The statute sets a reporting date and nothing more. It does not set a date by which the framework or the DFARS clause must be in force.

A pause on one track, a new law on the other

On July 13 the Department of Defense suspended CMMC Phase 2 and froze the later phases, pausing the very program this AI framework is supposed to plug into. The CIO’s suspension memorandum is the primary document. I have written about that suspension twice: what stayed live and where the False Claims Act risk moved, and why a memorandum is not a rule. I will not re-derive it.

What matters here is the sequencing. The rule that governs CUI today, NIST SP 800-171 Revision 2 as enforced through CMMC, was written for human users and static software. Its access control and audit families assume you can define, in advance, who is allowed to do what. An autonomous agent that decides its own tool calls at runtime does not fit that assumption, and I have covered that collision in Auditing the Unpredictable and Your Agents Are Your Newest Unmanaged Identities. The old rule has no category for the actor now doing the work.

The new rule, the one that would have a category for it, is the NDAA framework, and it is not the baseline contractors are assessed against. When the Department suspended CMMC Phase 2 in July, it tied the interim baseline to NIST SP 800-171 Revision 2, a control set with no entry for an AI agent. A defense contractor building agentic systems sits between two things: a baseline that cannot see its agents, and a successor framework that the statute directs but does not put in force. Section 1513 contemplates future DFARS and CMMC rulemaking; the statute by itself creates no contractor requirement. The only guidance in the gap is voluntary: OWASP’s Agentic Top 10 and the NIST AI Risk Management Framework. Voluntary guidance is not compliance; the DFARS clause that would make AI security a contract requirement is the rulemaking Section 1513 directs.

What to do with a law that is not in force

The easy response is to wait and see. I think that is a mistake, for a reason that is specific.

The two control families that make agents hard under 800-171 are the same two families that have always been hard. Access control, practices 3.1.1 through 3.1.3, limits access to authorized users and processes, limits the transactions they may execute, and controls the flow of CUI. Audit and accountability, practices 3.3.1 and 3.3.2, requires logs that let you trace an action to the person or process responsible.

An agent breaks the first family because a static role is a poor fit for a tool whose permissions change per task. It breaks the second because a log of which endpoint got called does not tell you why the call happened, and for a probabilistic system the why is the part that matters. The fix is not exotic. Give the agent its own identity instead of a shared service account. Scope its authorization to attributes checked at runtime: the sensitivity of the data, the operation, the risk posture. Log the reasoning, not just the actions, so an auditor can reconstruct why the agent reached for a tool. Those three steps map onto the access control and audit families 800-171 already enforces.

None of that is enforceable under CMMC today, and I am not claiming it is. I am also not predicting what the eventual Section 1513 framework will require. The statute says only that it must extend or augment the frameworks DoD already runs. What I can say is narrower. An AI security framework that is an extension of CMMC has to cover the two control families an agent strains, access control and audit, because those are the families CMMC already enforces through NIST 800-171. So agent identity, attribute-based authorization, and reasoning-level audit are where I would put the work first. They might not be what the rule ends up naming. They are the work that keeps its value either way, because they are what 800-171 already asks of every other system in the enclave.

What I am not saying

Three cautions, because this topic attracts confident wrong answers.

The pause on CMMC Phase 2 is not a repeal. NIST 800-171 Rev 2 remains in force through DFARS 252.204-7012, the safeguarding and incident-reporting clause. The NIST assessment scores contractors post to SPRS continue, now carried for new awards by 252.240-7997 in place of 252.204-7020, and the annual CMMC affirmation continues under 252.204-7021. DOJ’s Civil Cyber-Fraud Initiative, launched in October 2021, still uses the False Claims Act to pursue contractors who knowingly misrepresent their cybersecurity practices. Do not read this as “CMMC is dead, ignore it.” The certification path is paused. The obligation is not.

The NDAA framework creates no contractor obligation on its own. Section 1513 set a status update for June 16, 2026, and directs DoD to develop the framework and fold it into DFARS and CMMC, but it sets no implementation deadline and the statute by itself creates no enforceable contractor requirement. The framework and any DFARS clause are future rulemaking. Anyone who tells you exactly what the AI rule will require is forecasting, not reporting. The only things I am willing to lean on are the statutory text and the CRS and law firm summaries of it.

Most of the on-topic writing about agents and 800-171 is vendor or law firm content with a product or a client to sell. The primary sources are the NDAA, the Federal Register rules, the CRS summary, NIST, and OWASP. The prescriptions about what an agent needs, mine in the section above included, are not regulation.

Bottom line

Congress legislated the AI-era successor to CMMC before the human-era version finished rolling out. Section 1512 orders an internal DoD governance policy for AI. Section 1513 orders procurement security requirements folded into DFARS and CMMC, and it draws the boundary wide enough to catch model weights and training data. The old rule is paused and cannot see the agents already in the CUI path. The new rule is signed, but on its own it creates no contractor obligation; the DFARS clause that would give it force is the rulemaking Section 1513 directs. In between, the defensible move is to build agent identity, attribute-scoped access, and reasoning-level audit now, because it is the access-control and audit work 800-171 already asks for, extended to the actor now doing the work. That work holds up whether the AI framework lands on those same families or not.

Two sections, one framework

A pause on one track, a new law on the other

What to do with a law that is not in force

What I am not saying

Bottom line

Sources