Generative AI · Clarion Street

Oct 18, 2026 The Prompt Is Now a Data Channel: Keeping CUI Out of the Model
CUI protection was built for data at rest and data in transit. A prompt to a frontier model is neither, and each hop it takes, from prompt to cache to training, carries a different DFARS obligation. GSA's first AI-specific safeguarding clause takes effect October 19, 2026.
Sep 6, 2026 NIST's GenAI Profile Is Voluntary. Your Customers Didn't Get the Memo.
NIST's Generative AI Profile is the most concrete control content we have for GenAI risk, but it is voluntary, and the attestation regimes buyers actually enforce have no native GenAI language. The fix for mid-sized firms is to feed the profile's controls into the SOC 2 machinery they already run, not to build a parallel governance program.