L3Harris
- Written approval before you use AI on an order
- An inventory of your AI systems and use cases
- Labeling and human review of AI-generated deliverables
- Notice within 72 hours of an AI-related incident
For defense and federal subcontractors
Your primes now
have AI rules.
Be ready when they ask.
Kendrake reviews how your team uses AI tools like ChatGPT, Copilot and Claude against your primes' supplier terms. In ten business days you get a decision for each use, a fix list with owners, and a two-page summary you can send your prime.
No login. No government data. Preliminary findings in 10 minutes.
What changed in 2026
AI clauses are now in prime supplier terms.
Your staff already use AI on program work. These are the published terms of three large primes. Which ones bind you depends on what your purchase orders incorporate.
Northrop Grumman
- No training or testing AI on Northrop information
- AI use only when access is limited and nothing is retained
- Outputs with Northrop information treated as Northrop information
Lockheed Martin
CorpDoc 2 (2026), section 20(e)
- Lockheed information in AI only as the contract requires
- No export-controlled information in AI tools
- Traceability of AI-generated content on request
- Evidence you follow the DoD Ethical AI Principles on request
CUI rules did not pause either. CMMC Phase II is suspended, but DFARS 252.204-7012 and your self-assessment still apply to any AI tool that touches CUI. Read the prime terms guide
How it works
From scattered AI use to a record you can send.
- 10 minutes, free
Take the readiness check
Answer 18 questions about the tools your staff use, the data they touch and the terms on your orders. See your gaps right away.
- 10 business days
Run the Readiness Sprint
We inventory each AI use, map it to your contracts and data, and give it a clear decision: fine as is, fine with limits, verify first, or stop.
- Yours to keep
Send your prime the evidence
A use register, a fix list with owners, an acceptable use policy and a two-page AI use summary written for your prime. Refresh it quarterly as tools and terms change.
Who it's for
Built for the firms primes flow terms down to.
- You supply Lockheed Martin, Northrop Grumman, L3Harris or another large prime.
- You have roughly 75 to 300 employees in engineering, electronics, manufacturing or technical services.
- Your people use AI tools at work, and nobody has written down which tools, on what data, under which terms.
Who leads the work
Grounded in the DoD's own Responsible AI guidance.
Marc Estinville spent a year supporting the DoD Chief Digital and AI Office on its Responsible AI Toolkit, the guide for putting the DoD Ethical AI Principles into practice. Lockheed's 2026 terms let it ask suppliers to show they follow those same principles.
He has 17 years of product and program leadership across enterprise technology and federal programs, and holds a PMP, an MBA and a Six Sigma Black Belt.
About KendrakeQuestions that come up
Before you start
Primary sources
- CMMC Phase II suspension implementation guidance
- GSAR 552.239-7001, class deviation RGO-2026-01
- Lockheed Martin CorpDoc 2 (2026), section 20(e)
- Northrop Grumman CTM-P-ST-002 (Rev. 05/06/2026), clause 22(M)
- L3Harris LGL-50.F1 (Rev. 05/2026), articles 9(b), 15(g) and 17
Reviewed October 17, 2026. Recheck before relying on a finding.
Is the GSA AI clause final?
GSA released the final language of clause 552.239-7001 on October 13, 2026, under class deviation RGO-2026-01. Its effective date is October 19, 2026, and GSA plans to add it to Multiple Award Schedule contracts in Refresh 34 on November 6, 2026. It covers LLM functionality the government buys, including AI-enabled document and productivity tools, when Government Data goes into or comes out of the LLM. Unless the contracting officer identifies otherwise, contractor-internal tools not delivered to or accessed by the government fall outside it. Check the terms on the actual contract. If you deliver LLM functionality to a GSA customer, review it now.
Do primes really put AI rules in supplier terms?
Yes. Lockheed Martin, Northrop Grumman and L3Harris all publish 2026 supplier terms with AI clauses. Depending on the prime, they limit what information can go into AI tools, require written approval before AI use, ask for an AI inventory or let the prime request traceability of AI-generated content. The Prime supplier terms guide summarizes each one with its source.
Does CMMC cover our AI tools?
It depends on what the tool can reach. An AI tool that processes, stores or transmits CUI sits inside your assessment scope. Phase II third-party assessments are suspended, but self-assessments and DFARS safeguarding duties continue.
Are we in scope if we only use Copilot?
The name alone does not answer that. The exact offering, configuration, connectors, data and contract terms matter. The check identifies what needs review.
Is this legal advice?
No. This is readiness and documentation support. Contract interpretation goes to your attorney. Technical acceptance and business approval remain with the customer.
What do you store?
Forms collect only the metadata requested. Do not send government data, CUI, prompts, model outputs or contract text. Anonymous check answers are processed without email delivery. Requested reports, inquiries and surveys are delivered by email to Kendrake; contact details are collected only when you provide them. See Privacy for the handling and retention policy.
How long does it take?
The free check is designed for under 10 minutes for a small sample of tools. The paid sprint takes 10 business days after scope and required inputs are confirmed. Open fixes may take longer.
Field notes
Understand the questions behind the check.
Prime supplier terms
Prime supplier AI terms and each reported use
Large primes now write AI rules into their supplier terms. Map each AI use to the terms on your purchase orders.
SafeguardingAI tools and CUI under CMMC
Start with what the tool can access and which contract requirements apply.
Contract termsGSA AI clause 552.239-7001
Review the issued text and the procurement it applies to.
Agency directionOMB M-25-22 and M-26-04 for contractors
Agency policy and a contractor obligation are different steps in the review.
Developing requirementsNDAA Section 1513 and AI security
Congress has directed an AI security framework for defense contractors. Here is what is known and how to prepare.
Customer evidenceHow to answer a prime contractor AI questionnaire
Answer from records you can support, and make uncertainty visible.
Start with what you know
Find out where your AI use stands.
Ten minutes, free, no login. Then decide whether you need the sprint.