CUI Categories and Subcategories Relevant to AI Systems

AI systems change how Controlled Unclassified Information (CUI) can be exposed, because they combine information as well as retrieve it. Each category presents a different risk, from reconstructed personal profiles to exposed technical data. The central requirement is the same throughout. Protecting CUI means marking the documents an AI system reads and controlling what it can access, combine, and disclose.

Why CUI was built for a world AI has already overturned

Document-level permissions assume that controlling who can read a file controls how its information spreads. AI breaks that assumption at repository scale. A retrieval-augmented generation (RAG) pipeline can ingest documents, encode content as vector embeddings, and combine fragments in a natural-language answer. That answer can expose relationships the source files were never intended to reveal together.

Executive Order 13556 established the CUI program on November 4, 2010, to replace inconsistent agency handling policies with a common framework. AI adds a different problem because it can combine information from all the files it can reach. In a SharePoint environment with imperfect permissions, an AI system can index everything it can reach and surface sensitive content through an ordinary query.

How the CUI Registry organizes the exposure surface AI now has to navigate

The CUI Registry, managed by NARA, catalogs more than 120 categories across some twenty index groupings. Its two handling types distinguish baseline protection from category-specific requirements. CUI Basic applies where the governing authority does not prescribe controls beyond the standard baseline. CUI Specified applies where that authority sets different controls. Markings show which handling rules must stay with the information.

CUI Specified uses the “SP-” prefix, and 32 CFR 2002.20(b)(2)(iii) requires all applicable Specified categories in the banner marking. Limited Dissemination Control markings, including NOFORN, FEDCON, and REL TO, further restrict recipients. These markings do not enforce themselves in retrieval. A pipeline must clearly tell restricted documents apart from other content, and authorized holders must still identify and mark newly created CUI. If an AI-assisted workflow produces CUI that nobody recognizes, the marking can be missing before any routing decision begins.

Privacy CUI: where AI's synthesis capability most directly threatens individuals

Privacy is the broadest starting point across government and commercial settings. Readers familiar with state privacy laws, GDPR, or HIPAA will recognize the concern about personal information, but Privacy CUI has its own categories, including General Privacy, Health Information, and Personnel Records. The AI-specific danger is reconstruction across separate systems. A CRM record, an HR entry, and a benefits document can contain fields that seem unremarkable alone but form a detailed individual profile when combined.

That synthesis changes the nature of unauthorized disclosure. Unauthorized disclosure can occur when a user opens a file they should not see. An agent can read a CRM, query a financial database, and write to a collaboration platform through one prompt, without a person reviewing the combination before the response appears. Misconfigured enterprise permissions make this worse by exposing salary data or confidential executive communications to retrieval. The resulting answer can disclose more about someone than any individual source does.

Defense CUI and Controlled Technical Information: the category AI tools reach most often in the defense-industrial base

Controlled Technical Information (CTI) includes technical information with military or space applications that is subject to controls on access, use, and disclosure. Defense CUI also includes Naval Nuclear Propulsion Information and Unclassified Controlled Nuclear Information – Defense. A developer can submit CTI to a coding assistant or document summarizer, sending it to an external API and infrastructure absent from the organization’s System Security Plan.

Purdue’s CUI/CDI guidance explains how Covered Defense Information connects CUI to contract performance under the relevant DFARS clause. A cloud AI service that stores, processes, or transmits CUI falls within the contractor’s CMMC assessment scope. An undocumented tool can leave applicable requirements assessed as NOT MET, particularly around access control, attributable audit records, and communications protection. The False Claims Act risk arises from an inaccurate SPRS score or affirmation.

Export Control CUI: why ITAR and EAR data are the highest-consequence AI disclosure

Export Control CUI includes Export Controlled information, which covers ITAR/EAR technical data, as well as Export Controlled Research. ITAR treats disclosure of technical data to a foreign national anywhere, including within the United States, as an export. Even when the disclosure is an accident, it can be an unauthorized export. A cloud AI service may expose data sent to it through infrastructure hosted abroad or through foreign national employees who run that infrastructure.

Subprocessor opacity makes this difficult to assess before submission. A SaaS platform may pass a document to an underlying AI model that the organization never reviewed, while its data processing agreement does not cover that undisclosed subprocessor. Export Controlled Research has a separate access risk when AI shows restricted research results to researchers who are not allowed to see them. Purdue’s framework requires a check of whether a fundamental research determination applies before the information can be treated as free to share. An AI research assistant cannot make that determination, so governance must prevent the workflow from bypassing it.

Intelligence CUI: the category where AI's cross-document synthesis is most operationally dangerous

Intelligence CUI makes aggregation itself the central threat. Relevant subcategories include General Intelligence, Foreign Intelligence Surveillance Act (FISA), FISA Business Records, Internal Data, and Operations Security (OPSEC). Unclassified pieces of information may reveal little on their own. An agent with broad repository access can correlate them into sources, methods, or operational patterns that no individual document exposes.

OPSEC provides the clearest parallel for this risk. It protects information whose combination reveals operational vulnerabilities, which is precisely what cross-document synthesis can produce from inside an access boundary. Autonomous queries deepen the problem because correlations can form faster than a human reviewer can detect them. Without governance that records cross-system access sequences, the organization may also lack an audit trail of how the answer formed. FISA-related records also have handling rules set by law, which must be met even if a generic CUI control handles other categories correctly.

Law Enforcement and Legal CUI: the categories where AI disclosure carries direct harm to named individuals

Exposing a whistleblower or informant can put a person in physical danger. The consequence is not just a compliance finding. A RAG pipeline that returns an identity to an unauthorized user can create an immediate life-safety risk. Other relevant categories, including Juvenile Law Enforcement, Sex Crime Victim, and Witness Protection, likewise concern harm to identifiable people.

Legal Privilege requires control over routing as well as access. Attorney Client and Attorney Work Product are Limited Dissemination Control markings usable only with that category. A shared retrieval corpus can cross the privilege boundary when it makes protected communications available outside their permitted route. Criminal History Records Information has statutory restrictions on who may query, receive, or use it. An HR assistant does not satisfy those restrictions merely because its connection to the source was authorized when its answer reaches someone who is not.

Procurement, Financial, and Proprietary Business Information CUI: the categories that corrupt competitive processes when AI crosses them

An enterprise AI assistant can retrieve source-selection documents in the same query session it uses to help write a proposal. That creates a conflict without requiring deliberate misconduct. Source-selection information and contractor bid or proposal information protect how competitors plan to do the work and what they charge. An agent with access across those repositories can breach walls established for legal reasons, even when its technical permissions allow the retrieval.

Financial CUI extends this problem beyond competitive bidding. Bank Secrecy and Financial Supervision Information have handling rules set by law that general-purpose query access can break when examination data reaches people who are not allowed to see it. Budget information can pose a pre-decisional risk if it is shared before publication. An assistant can surface planning documents to employees who could not receive them through normal channels. Proprietary Business Information likewise covers commercially sensitive information that the government holds, and AI can expose it in much the same way as Confidential-tier commercial data, so it needs similar protection.

Critical Infrastructure CUI: the category where AI's access to vulnerability information is itself a vulnerability

Critical Infrastructure CUI protects information an adversary could use to attack systems or facilities. Protected Critical Infrastructure Information (PCII) and information about chemical facilities’ vulnerability to terrorism are CUI Specified, with rules on who can access them and what they can be used for. Broad repository permissions do not satisfy those restrictions. AI governance must enforce purpose-limited access at the query level, rather than assume that permission to ingest documentation permits every later use.

Information Systems Vulnerability Information makes the new attack surface concrete. An adversary able to query a RAG system may not need credentials to the underlying repository if prompt injection or misconfigured retrieval causes the system to disclose vulnerability information. The AI becomes an indirect route to the records. Combining Physical Security information with documents on cyber vulnerability can reveal physical access points and their weaknesses in one response. That combined picture could support an attack neither source document alone would explain.

What ISOO Notice 2026-01 and the September 2026 contract guidance require organizations to do now

ISOO Notice 2026-01 addresses agency handling of CUI with AI systems and tools. Its prohibition turns on connectivity and the protection of the operating environment. Agency personnel may not input CUI into systems that meet the notice’s prohibited conditions, including Internet-enabled systems, connections to infrastructure outside agency control, or environments that lack the required protection. The system’s actual boundaries determine the assessment.

The notice distinguishes three system types with different exposure profiles. A closed system has a fixed boundary, controlled inputs, and no environmental learning. An asymmetric open/closed system can take in outside information while keeping information from the user within the user’s session or control boundary. The notice describes this design as common in regulated deployments. Open systems are generally unsuitable for CUI under its framework, but the prohibition depends on the system’s accreditation and isolation.

NARA’s September 2, 2026, notices require agencies to give contractors specific guidance for every contract that requires access to CUI. That guidance covers identification, safeguarding, and processes for challenging designations. Contractors need to know which information their governance decisions must cover. The FAR Council’s proposed CUI rule aligns with that approach by proposing a standard contract form itemizing expected CUI. The proposal is distinct from the issued notices, but both address the uncertainty that leaves contractors inferring what requires protection.

Matching CUI category risk to AI architecture: the four-tier deployment decision

Sensitivity should determine deployment, rather than a tool purchase determining where sensitive data goes. The four-tier framework distinguishes Public, Internal, Confidential, and Restricted data. Public allows cloud AI without special controls, while Internal calls for enterprise AI with audit trails, access logging, and data processing agreements. Managed cloud is acceptable at that Internal tier. Confidential calls for private cloud or on-premises AI with encryption and mandatory access logging, and data must stay within the organization’s control.

Restricted is the strictest tier in this framework. It calls for air-gapped or single-tenant architecture with physical isolation and human review, and no data may be sent to the cloud. Export Control CUI, Intelligence CUI, the specified high-risk Critical Infrastructure categories, and all CUI Specified belong there. Privacy, Defense, Law Enforcement, Legal, and Procurement CUI require Confidential controls at minimum, with stricter handling taking precedence where applicable. A minimum is not permission to disregard a Restricted designation or a category-specific obligation.

The required controls include a registry of every AI tool and MCP server touching CUI, role-based access enforced at the agent level, and live visibility into what each agent accesses and combines. Retrospective logs alone cannot stop an unsafe synthesis. A live control can intervene before an agent joins information across a boundary it should not cross. With that visibility and control in place, organizations can expand AI into sensitive production workflows instead of treating their only safe option as keeping AI out.