Does DFARS 252.204-7012 apply to AI systems handling CUI?
Yes — if a contractor's AI system stores, processes, or transmits Covered Defense Information / CUI, DFARS 252.204-7012 applies, requiring NIST SP 800-171 safeguarding and rapid (72-hour) cyber-incident reporting. The AI component is in scope like any other…
Answer.
Yes — if a contractor's AI system stores, processes, or transmits Covered Defense Information / CUI, DFARS 252.204-7012 applies, requiring NIST SP 800-171 safeguarding and rapid (72-hour) cyber-incident reporting. The AI component is in scope like any other system touching CUI. Planisphere can supply reproducible behaviour evidence for the AI's 800-171-relevant controls; it does not handle incident reporting or assert full clause compliance for you.
The mark behind the answer.
CUI handling · 72-hour breach reporting.
Try DFARS 252.204-7012 with a free test key.
Start with the free sandbox. Planisphere measures model behaviour and emits a reproducible, sha-pinned record — it does not certify, file, or give legal advice.