Docs

CUI, ITAR, and Classified Information

ExChek can be used with Controlled Unclassified Information (CUI) and § 126.18-controlled ITAR technical data inside an accredited environment — an on-premises/air-gapped setup or a compliant secure enclave. Classified information may be processed only on a system accredited for that classification level. General-purpose commercial cloud AI (consumer Claude, ChatGPT, Gemini, Perplexity, and similar) must never be used for any of this content.

Every ExChek skill opens with a three-question gate (CUI? classified? § 126.18 ITAR?). The gate no longer auto-refuses — it asks, and lets you proceed only if you explicitly confirm an environment accredited for the content involved.

CUI and ITAR § 126.18 technical data — accredited environment

You may process CUI or § 126.18-controlled technical data with ExChek when you can confirm all of the following about the environment you're running in:

  • The model runs inside an accredited boundary — an on-prem/air-gapped deployment, or a government/enterprise secure enclave (e.g. AWS GovCloud, Microsoft Azure Government, or equivalent) authorized for this data. You are not relaying the content to a general-purpose public AI outside that boundary.
  • The controls are met — for CUI: DFARS 252.204-7012 / NIST SP 800-171 / CMMC 2.0, typically FedRAMP High or DoD Impact Level 4/5. For ITAR § 126.18: access limited to U.S. persons (or exactly the foreign persons your TAA/MLA/exemption authorizes), with the encryption and access-control conditions documented.
  • No training, retention, or external logging — the platform does not train on, retain, or log your data outside the accredited boundary (a zero-retention / no-training configuration).
  • No controlled content leaves the boundary — item descriptions, technical data, source code, and party names are not sent to external cloud endpoints, including the ExChek API at api.exchek.us and the Trade.gov CSL at data.trade.gov. Send only non-controlled tokens (CFR part numbers, generic search terms) to any external service; use on-prem regulatory data (below) for the rest.

When you confirm, the skill proceeds and records your attestation (environment, accreditation/impact level, U.S.-person basis, who, when) in the report's AI Tool Usage & Currency Disclosure section. If you cannot confirm every point, use the on-prem setup below instead.

Classified information — accredited classified system only

Classified information (Confidential / Secret / Top Secret / SCI) may be processed only on a system accredited for that classification level — an authorized classified network or enclave. A CUI-level enclave (FedRAMP High / IL4-5) is not sufficient. If you cannot confirm an accredited classified system at or above the data's level, do not proceed — stop and consult your security office. Classified material must never be sent to any general-purpose commercial cloud AI.

On-prem / air-gapped setup (fallback and offline path)

When you can't confirm a compliant secure enclave — and always for classified without an accredited system — run ExChek entirely inside your boundary with a local LLM. Do not configure the agent to use any external cloud API LLM when processing controlled items.

  1. Obtain the skill files as an offline bundle — Download the ExChek skills as a ZIP (do not rely on live cloud sync) and transfer them to your environment via your organization’s approved method (e.g. air-gapped media, secure transfer).
  2. Install locally — Unzip and place the skill in your local agent’s skills directory (e.g. ~/.claude/skills/exchek-classify or the equivalent for your on-prem/enclave agent platform).
  3. Use an in-boundary LLM only — Run the agent that executes the ExChek skill against a local LLM hosted within your secure boundary. No external cloud or API LLM when processing controlled items.

Getting the latest Part 774 and Part 121 in-boundary

The ExChek skill uses regulatory data from 15 CFR Part 774 (Commerce Control List, CCL) and 22 CFR Part 121 (United States Munitions List, USML). For on-prem or air-gapped use, you need to obtain the latest 774 and 121 data inside your environment so the local agent can use it without calling external cloud APIs.

Option 1: Run the ExChek refresh script in-boundary

If you have the ExChek API codebase in your environment (e.g., from the full ExChek repo or a released package), you can run the eCFR snapshot refresh script. It fetches the current title structures from eCFR (ecfr.gov), extracts Part 774 and Part 121, and writes them to local JSON files. No Supabase or cloud storage is required for local-only use.

  1. From the apps/api directory of the ExChek repo, ensure dependencies are installed (npm install).
  2. Run the refresh script:
node scripts/refresh-ecfr-snapshot.js

By default, the script writes ecfr-part-774.json and ecfr-part-121.json to apps/api/.data (or the directory set in ECFR_SNAPSHOT_DIR). Configure your in-boundary API or agent to read 774/121 from this directory so the skill can use the latest CCL and USML data without calling the public ExChek API.

Option 2: Fetch from eCFR and extract the parts

If you cannot run the ExChek script in-boundary, you can fetch the latest structure from eCFR and extract the parts manually:

  1. From a system that is allowed to reach eCFR (e.g., a boundary host), download the current title structures:
curl -o title-15.json "https://www.ecfr.gov/api/versioner/v1/structure/current/title-15.json"
curl -o title-22.json "https://www.ecfr.gov/api/versioner/v1/structure/current/title-22.json"
  1. Transfer title-15.json and title-22.json into your environment using your approved process.
  2. Extract the Part 774 subtree from title-15.json (the node whose identifier or label is Part 774) and save it as ecfr-part-774.json. Extract the Part 121 subtree from title-22.json and save it as ecfr-part-121.json.
  3. Place both JSON files in a directory your in-boundary agent or API can read, and point the skill or local API to that directory so classification uses this data instead of any cloud endpoint.

Run this process periodically (e.g., weekly) to refresh 774 and 121 when eCFR is updated.

Related