The C3PAO AI-Usage Checklist: 12 Questions Your Assessor Will Ask in 2026

Bottom line up front: your C3PAO assessment will include questions about AI usage, because prompts to ChatGPT, Copilot, and Claude are data flows across your external boundary — squarely inside NIST 800-171's scope. Below are the 12 questions to prepare for, grouped by control family, each with the evidence that answers it. If you can answer all 12, AI usage becomes a strength in your assessment instead of a finding.

Flow control and external systems (3.1.x)

1. "Which AI tools are in use in your environment, and how do you know?" — Evidence: an inventory of approved AI endpoints and the proxy configuration that makes any other path unavailable from organizational systems.
2. "How do you prevent CUI from being entered into AI tools?" — Evidence: the technical control (local scanning proxy with blocking policy), not just the written policy. See AC.2.003 — Control CUI flow.
3. "Are AI services treated as external systems in your SSP?" — Evidence: SSP section listing AI endpoints as controlled external connections (AC.2.020), with the data-flow diagram showing the inspection point inside your boundary.
4. "Can employees reach AI tools from personal accounts on organizational systems?" — Evidence: network-level routing through the gateway; browser/device policy for the rest.

Audit and accountability (3.3.x)

5. "Show me the log of AI usage." — Evidence: the audit trail of allowed and blocked prompt events with timestamps and user attribution (AU.2.001).
6. "Can an AI prompt event be traced to an individual?" — Evidence: per-user attribution in the log (AU.2.002) — shared accounts fail this instantly.
7. "How do you know the log hasn't been altered?" — Evidence: tamper-evidence — HoundShield uses a SHA-256 hash chain, so any modification breaks verification (AU.2.008).

Boundary protection (3.13.x)

8. "Where are AI-bound communications monitored and controlled?" — Evidence: the proxy as a named boundary control (SC.1.001). Deployment mode matters here: scanning must happen on your own infrastructure — a cloud-scanning DLP moves the CUI exposure to the DLP vendor.
9. "What patterns does the control detect?" — Evidence: the active detection set (CUI markers, contract identifiers, ITAR indicators, PII/PHI) and the block/quarantine policy configuration.

Incident response (3.6.x)

10. "What happens when someone attempts to send CUI to an AI tool?" — Evidence: the blocked-event workflow — alert, review, disposition — and a sample record.
11. "Walk me through your response if CUI actually reached a public AI service." — Evidence: your incident-response plan naming this scenario, the 72-hour DIBNet reporting path, and evidence-preservation steps. Our incident-response playbook is the sequence.

Policy and training

12. "Show me your AI acceptable-use policy and the training record." — Evidence: the signed policy (use our control-mapped template) and training acknowledgments referencing AI scenarios.

Walking in prepared

Every question above is answerable from one architecture: AI traffic routed through a locally hosted scanning proxy, a hash-chained event log, and a written policy the control enforces. The $499 CMMC AI Risk Assessment packages exactly this into a signed PDF after 14 days in your environment — the artifact you hand across the table when question 5 lands. For the control-by-control detail, the full 110-control reference marks which requirements AI monitoring evidences and which it honestly does not.