CMMC Level 2 Phase 2 assessments mandate evidence-driven verification of software provenance, including AI-generated code. Traditional SBOMs enumerate dependencies but lack metadata about AI code authorship, review, and context. This gap poses a compliance risk for organizations relying on AI-assisted development, especially in the defense industrial base. Recommended controls include commit-level attribution of AI-generated code, adoption of AI-BOM formats capturing model and training data provenance, and enforcing human review gates on AI-assisted commits before merging to protected branches. These measures ensure traceability and compliance with CMMC requirements effective November 2026.

Organizations that generate SBOMs without capturing AI-generated code provenance risk failing CMMC Phase 2 assessments, which require verifiable chains of custody for software components. This compliance gap may lead to contract eligibility issues for defense industrial base companies. The issue is not a direct technical vulnerability but a governance and compliance challenge related to software supply chain transparency and auditability.

A fix is not a traditional software patch but procedural and tooling changes. Organizations should implement policies to label AI-generated code commits, adopt emerging AI-BOM standards to capture AI model provenance, and enforce human review of AI-assisted code before merging. These controls align with CMMC Phase 2 requirements and address the compliance gap. Organizations have a five-month window before November 2026 to implement these measures. No vendor patch or official fix applies as this is a compliance and process issue.