Medicine · CMMC

CMMC for clinical AI workflows

CMMC in clinical AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Start free Open the Console

Legal forceBinding on DoD contractors through contract

Applies from10 Nov 2025

SectorMedicine

Checked21 Oct 2026

01 / The rule

What CMMC requires

Defense contractors and subcontractors that process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor systems.

01Level 1: annually self-assess against the 15 FAR 52.204-21 safeguarding requirements and affirm in SPRS.
02Level 2: meet the 110 NIST SP 800-171 Rev. 2 requirements, by self-assessment or C3PAO assessment every three years.
03Level 3: hold Level 2 certification plus a government (DIBCAC) assessment of 24 NIST SP 800-172 requirements.
04Post results in SPRS and have a senior official affirm compliance annually.
05Give the contracting officer the CMMC unique identifiers (UIDs) for systems handling FCI or CUI and report any changes to them during performance (DFARS 252.204-7021(e), NOV 2025).
06Flow down the required CMMC level to subcontractors handling FCI or CUI.

02 / In this sector

In a clinical AI workflow

Applies to AI systems as to any system: AI tools, models or cloud AI services that process FCI or CUI fall inside the assessed boundary and must meet the same controls.

Usually asked by

Clinical committees and health system AI governance.

Named alongside

HHS §1557 · HIPAA · FDA PCCP.

Sector pagePlanisphere for medicine

03 / Records

Records to keep

01System security plan covering the assessment boundary
02SPRS score and annual affirmation records
03Plan of action and milestones with closeout dates
04CMMC certificate or self-assessment results and UID

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES