Agentic AI does not get a governance exemption under CMMC or state privacy law, and it is not automatically covered by either. Each regime asks specific questions. For DoD work, the question is whether a contractor system used on the contract processes, stores, or transmits federal contract information (FCI) or controlled unclassified information (CUI). For state privacy law, the questions are whether personal information is processed in a state whose law applies, and whether the system is used to make or materially influence a consequential or significant decision. The sections below apply those tests, list the dates that matter as of October 2026, and state the limits of this analysis.
Why the word “agentic” does not decide the question
Neither framework is written around the words “AI” or “agent.” CMMC asks what protected information a contractor system handles on a covered contract. State privacy law asks what personal information is processed, about whom, and for what decision. An agent is a deployment pattern: software that plans steps and takes actions across tools. Whether obligations attach depends on the data it touches and the systems it runs on, not on how autonomous it is.
As an Amazon Associate I earn from qualifying purchases.
Two examples show the difference. An agent that summarizes unclassified program documents inside a contractor system used on a DoD contract may fall within CMMC. A customer-facing agent on a retail website that never touches FCI or CUI may fall outside CMMC altogether, though it can still raise state privacy questions depending on the personal information it processes and where its users live.
CMMC: the trigger is the system and the information
The DFARS Cybersecurity Maturity Model Certification subpart applies to unclassified contractor information systems. Where a contract includes a CMMC requirement, the contractor must maintain the specified CMMC level or higher for each contractor information system used to perform the contract that processes, stores, or transmits FCI or CUI. The framework is set out in DFARS Subpart 204.75 (revised November 10, 2025), and the contract provisions are in the current DFARS Part 252.204 text.
What this means for an agent
The obligation attaches to the system that handles protected information, so an agent’s scope follows its data path. If an agent reads CUI, sends it to a vendor-hosted model, or saves its outputs to a repository, those flows are the facts that matter. Map where the data goes before concluding that an agent sits outside the system boundary.
Status is continuing, not a one-time sign-off
DFARS requires current CMMC status and an affirmation of continuous compliance recorded in the Supplier Performance Risk System (SPRS), and the affirmation is annual under the clause. Currency periods differ by status (conditional versus final), by level (Level 1 versus Level 2 or 3), and by type of submission. Check the applicable clause and your organization’s own status rather than assuming a single recertification cycle.
Rank #2
Flowdown to subcontractors and service providers
The contractor must flow the correct CMMC level down to applicable subcontracts and other covered contractual instruments. An agent vendor or managed-service provider that handles FCI or CUI for a subcontractor may therefore sit inside the flowdown chain, and the question has to be answered at each tier.
Recommended Free Tools
California: a rule package in force, with staged compliance dates
The California Privacy Protection Agency (CPPA) package covering CCPA updates, cybersecurity audits, risk assessments, and automated decisionmaking technology (ADMT) was approved by the Office of Administrative Law and filed September 22, 2025. It took effect January 1, 2026. Its obligations are staged. The dates below are as stated in the CPPA’s September 23, 2025 announcement, and the package is described on the CPPA’s regulations page.
Rank #3
| Obligation | Date stated by the CPPA |
|---|---|
| Rule package effective | January 1, 2026 |
| Risk-assessment compliance begins | January 1, 2026; attestation and summary due to the CPPA by April 1, 2028 |
| ADMT requirements for businesses using ADMT to make significant decisions | January 1, 2027 |
| Cybersecurity audit certification, businesses making over $100 million | April 1, 2028 |
| Cybersecurity audit certification, businesses making between $50 million and $100 million | April 1, 2029 |
| Cybersecurity audit certification, businesses making under $50 million | April 1, 2030 |
What counts as ADMT is the open question
Do not treat every AI tool as regulated ADMT. The CPPA’s proposed regulation text of November 22, 2024 defined ADMT as technology that processes personal information and uses computation to execute a decision, replace human decisionmaking, or substantially facilitate human decisionmaking, and it expressly included software derived from AI. That is proposed language, not the approved text. Before you state a controlling definition, exemption, or scope, verify it against the approved regulations on the CPPA site.
The proposed wording reaches tools that substantially facilitate human decisions, so a human reviewer does not by itself settle the question. The reviewer’s role is one fact to document alongside what the agent actually produces.
The agency’s own framing
The CPPA’s announcement quotes Jennifer Urban, Chair of the California Privacy Protection Agency Board: “These rules ensure that Californians continue to have the strongest privacy protections in the country while being responsive to the realities of business implementation.” It also quotes Phil Laird, General Counsel for the agency: “The regulations provide clarity for businesses, while ensuring strong protections for Californians.” Both are the agency’s characterizations of its own rules, not neutral readings of how they apply to a given system.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Colorado: an enacted update and draft rules, kept apart
SB 26-189 changes the statute
According to the Colorado Attorney General’s automated decision-making technology and chatbot safety rulemaking page, SB 26-189 was signed in May 2026. It repealed and reenacted the prior ADMT provisions with new requirements for ADMT used in consequential decisions. The law places requirements on developers whose ADMT materially influences consequential decisions and on deployers, and it gives consumers the right to request and correct inaccurate personal data used by ADMT. The updated provisions take effect January 1, 2027.
Draft rules are not yet requirements
The same page reported that interim draft ADMT and chatbot rules were released October 6, 2026, with formal comments accepted through October 26, 2026. These drafts are part of an active rulemaking process. Until they are finalized, they do not impose requirements, so plan against the enacted statute and track the rulemaking separately.
Colorado’s existing privacy law is a separate test
The Colorado Privacy Act gives consumers rights concerning sale, targeted advertising, and certain kinds of profiling, according to the Attorney General’s Colorado Privacy Act page. Whether it reaches a given agent turns on the entity, the processing, and the context. It should not be assumed to cover employment data or every AI use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Scope tests for an agentic deployment
The following questions organize the analysis above. They are an editorial framework, not steps the statutes prescribe.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
- Federal contract information. Does the agent, or any tool it connects to, access, store, process, or transmit FCI or CUI in a contractor system used on a DoD contract? If yes, identify the contract’s required CMMC level and the system boundary.
- Personal information. Which personal information does the system process, about whom, for what purpose, and in which states?
- Decision use. Is the system used to make, or materially influence, a consequential or significant decision? In California, test against the approved ADMT text. In Colorado, test whether the decision is consequential under SB 26-189.
- Human role. Record what the agent drafts or decides and what reviewers change before use. That record is what you will need to answer the decision-use test.
- Vendors and flowdowns. Who operates the system, and which vendor or subcontractor receives the data? Review contracts, flowdowns, access permissions, logging, incident handling, retention, and change control. Where DFARS requires CMMC flowdown, pass the correct level down.
- Effective dates. Which obligations are already in force, which are prospective, and which depend on draft rules? Keep California’s staged dates and Colorado’s rulemaking status current.
How the two regimes differ
| Axis | CMMC (DoD contracts) | State privacy and ADMT (California, Colorado) |
|---|---|---|
| Primary trigger | Contractor system used in contract performance that processes, stores, or transmits FCI or CUI; the contract sets the required level | Processing of personal information under the applicable state law; ADMT duties depend on the decision use and the statute’s scope |
| What is protected | Federal contract information and CUI in covered systems | Personal data of consumers and people affected by covered processing or decisions |
| How compliance is shown | CMMC status recorded in SPRS with an affirmation of continuous compliance; subcontract flowdown | Privacy rights, risk assessments, cybersecurity audit certifications, and ADMT requirements, depending on the state and date |
| Time sensitivity | Clause text and status and affirmation intervals | Effective dates, staged deadlines, amendments, and pending rulemaking |
| Coverage in this article | Federal DoD contracting | California and Colorado only, not a full state survey |
Limits of this analysis
- This is general information, not legal advice. CMMC applicability depends on the solicitation or contract, the information type, the system boundary, and the required level.
- Privacy applicability depends on jurisdiction, entity, affected people, data, and processing or decision use.
- The article covers federal DoD contracting and the California and Colorado materials cited above. It does not survey every state statute, threshold, exemption, or effective date, so it is not a national compliance map.
- Proposed and draft texts are flagged where they appear, and they should not be read as final law.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
