Federal agencies have long struggled to manage so-called controlled unclassified information, or CUI. Now, artificial intelligence is posing new and urgent challenges to how agencies handle, share and protect that sensitive information.
But the head of the government’s lead information security policy shop also sees opportunities for AI to help fix longstanding challenges with the management of CUI.
Michael Thomas, director of the Information Security Oversight Office (ISOO) within the National Archives and Records Administration, said large language models and AI have “transformed the way that the public thinks about access, and the government is trying to keep up.”
ISOO provides policy oversight and guidance to agencies on CUI, as well as classified national security information.
“Obviously, I think anyone who deals with CUI to a great extent could explain to you all the ways that that’s not working perfectly,” Thomas said during an April 9 webinar hosted by the Digital Government Institute.
“But I do think this is a particular area where AI and automation can be transformative,” he added, “helping us identify different types of information with less friction, with much greater precision and fidelity to the underlying law regulation or federal policy that provides the basis for that information’s protection.”
The governmentwide CUI program was established in 2010 to provide a uniform approach to how the government manages sensitive, but unclassified information that needs protections from public disclosure.
The National Archives lists more than 125 categories of CUI, ranging from technical weapon systems information and law enforcement sources to agricultural data and patent applications.
Rules governing the sharing and protection of CUI, however, have been applied inconsistently by agencies, leading to uncertainties around costs and compliance.
Thomas said one key challenge is that “folks aren’t tying the way they want to constrain the sharing of information back to the underlying law regulation or federal wide policy.”
“What is that actually telling you to do with the information, and are you adhering to those rules? Versus a looser idea of, well, I can’t share this … that sometimes constrains information unnecessarily, and in some cases, could lead it to be shared indiscriminately,” Thomas said.
AI has only amplified concerns about improperly sharing sensitive but unclassified data, and how the ability to bring together large amounts of data could be abused by U.S. adversaries or other bad actors.
“We’re trying to advise agencies that a strategy of security through obscurity is increasingly difficult in a world where this mosaic effect that we’ve long worried about in intelligence circles – how information can be put together to create value for our enemies – it’s no longer a threat or a worry, it’s just the reality of what the tools today can do,” Thomas said. “We realize that unclassified information is being extensively targeted for just these reasons.”
In late March, ISOO released new guidance to agencies on the “Responsible Use of Classified National Security Information and Controlled Unclassified Information with Artificial Intelligence.”
The guidance highlights the Trump administration’s push to leverage AI, while reminding agencies to ensure those systems comply with policies governing classified information and CUI.
Thomas said the guidance is intended to “help agencies its response to concerns that we had from agencies that they weren’t sure where to look for proper instruction on the use of AI, how to manage their information.”
From ISOO’s perspective, Thomas said officials see promise in how AI could help address issues with CUI tagging and sharing. “There’s a lot of different use cases for agencies,” he said.
“This is the double-edged sword of these tools, is that they’re going to require some front-end thinking to make them work properly,” Thomas continued. “But once they do, they’re going to open up a lot of opportunity to get past some of the enduring challenges that we’ve had with these programs.”
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
