AI in government and defense
Government and defense AI tends to sit in eligibility, case work, procurement, and the systems a contractor runs in an agency's name. The Intelligence Audit reads those uses from the inside, including the civilian and defense duties that are not the same control.
How AI shows up
An eligibility tool scores a benefit. A case system summarizes a file. A public chat answers before a person does. Procurement staff use a model to read proposals. On the defense side, the same pattern shows up in maintenance, logistics, and document review, and in tools a contractor operates while the agency's name stays on the decision.
Agencies are also being asked for an inventory of AI uses. A pilot that never made the inventory is still a use. Shadow AI in a program office, and a vendor feature switched on inside an approved platform, are both in scope.
Rules the audit looks at
The names below are examples the Regulatory and Compliance part and the Sector Controls part look at with your counsel. Listing one is not a determination that it applies to you, and it is not legal advice.
- CMMC, where the organization handles federal contract information or controlled unclassified information for the Department of Defense
- FedRAMP, where a cloud service is offered for federal use
- The NIST AI Risk Management Framework, which agencies and contractors are often asked to use, though it is not itself a statute
- Executive Order 14434, for the federal rename of AI in non-statutory communications
- The Colorado AI Act, where a system makes or strongly shapes a consequential decision about a person, including eligibility
CMMC is not FedRAMP, and neither one is a substitute for knowing what the system is allowed to decide. Executive Order 14434 is the page for what the federal rename changes and what it does not. Your counsel confirms which duties bind the agency or the contractor.
What the audit checks
Sector Controls follows the public record and the contract. For a civilian agency that includes the AI use-case inventory and the path from a model output to a benefit, a case action, or a public answer. For defense work it includes whether controlled information is in the prompt, the log, or the vendor's cloud. Regulatory and Compliance maps the jurisdictions with your counsel.
Go-to-Market is narrower here than in a consumer business, and it is not absent. Recruiting, vendor marketing into the program office, and public claims about a system's performance are still uses. Vendor and contract review, decision rights, and the security and rollout review matter because a cloud authorization is not the same thing as an owner who can stop the use.
Before we walk you through it, every Intelligence Audit is reviewed with our counsel. The review is ours, and it is not legal advice to you. The next step after the Assessment report is the Discovery Call.
Questions about this sector
Does Executive Order 14434 rewrite a defense contract?
No. Executive Order 14434 changes naming in non-statutory federal communications. It does not by itself rewrite a contract, a control, or a historical document. The audit still reads the uses. The order is one example to look at with your counsel. The longer account is on the Executive Order 14434 page.
What is the difference between CMMC and FedRAMP in this audit?
CMMC is the cybersecurity standard for certain defense-contractor information. FedRAMP is the authorization path for cloud services offered for federal use. A company can face one, both, or neither. The audit asks which systems and which data are actually in scope. It does not issue either authorization.
What does Sector Controls check for an agency?
It tests the inventory and the practice. That includes AI uses a program office adopted outside the official list, and uses a vendor runs in the agency's name. The check is read-only and with permission. Our counsel reviews the audit before we walk you through it. That review is not legal advice to you.
How an engagement with us works
- 01
Intelligence Assessment
A short written read from your answers and what is public
Read - 02
Discovery Call
We talk through the organization and the decision in front of you
Read - 03
Scope and Agreement
Scope is agreed in writing before the audit begins
Read - 04
Intelligence Audit
Eleven parts of work from the inside, and the architecture sits inside that work
Read - 05
Roadmap Preparation
The implementation plan for 90 days, 6 months, and 12 months
Read - 06
Counsel Review
Our counsel reviews the audit before we walk you through it. It is not legal advice to you.
Read - 07
Audit Delivery
The report, the architecture map, the plan, and a leadership readout
Read - 08
Ongoing Advisory
We stay when a capability or a rule changes
Read
AI consultingAI governance consultingSuperintelligence consulting
Updated
Start the Intelligence Assessment
Tell us about the organization and the question in front of you. We read every request and reply to the work email you give us.
Start the Intelligence Assessment