Planisphere Download for Mac

Law · DFARS 252.204-7012

DFARS 252.204-7012 for legal AI workflows

DFARS 252.204-7012 in legal AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceBinding on DoD contractors through contract
Applies from31 Dec 2017
SectorLaw
Checked21 Oct 2026

01 / The rule

What DFARS 252.204-7012 requires

DoD contractors and subcontractors whose information systems process, store or transmit covered defense information, or that provide operationally critical support.

  1. 01Implement NIST SP 800-171 on covered contractor systems; DoD's class deviation holding contractors to Rev. 2 (2024-O0013, Revision 1) says it stays in effect until rescinded.
  2. 02Ensure external cloud providers storing covered defense information meet security equivalent to the FedRAMP Moderate baseline.
  3. 03Report cyber incidents to DoD via DIBNet within 72 hours of discovery.
  4. 04Submit discovered malicious software to the DoD Cyber Crime Center (DC3).
  5. 05Preserve images of affected systems and relevant monitoring data for at least 90 days after reporting.
  6. 06Flow the clause down unaltered to subcontractors handling covered defense information.

02 / In this sector

In a legal AI workflow

Applies to AI systems as to any system: putting covered defense information into an AI tool or external AI cloud service brings that service into scope, including the FedRAMP Moderate equivalency requirement for cloud providers.

Usually asked by

General counsel and litigation support.

Named alongside

FRE 702 · ABA Model Rules.

Sector pagePlanisphere for law

03 / Records

Records to keep

  1. 01System security plan and NIST SP 800-171 assessment
  2. 02SPRS basic assessment score
  3. 03Cloud provider FedRAMP Moderate (or equivalent) documentation
  4. 04Incident reports, DIBNet report numbers and 90-day image retention logs

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

SECONDARY

RELATED

Related: DFARS 252.204-7012: the full guide · DFARS 252.204-7012 for defense · DFARS 252.204-7012 for medicine · DFARS 252.204-7012 for education