Docs

CUI Information

ExChek skills open with a CUI-only gate. Controlled Unclassified Information (CUI) may be processed inside an accredited environment — an on-premises/air-gapped setup or a compliant secure enclave. General-purpose commercial cloud AI (consumer Claude, ChatGPT, Gemini, Perplexity, and similar) must never be used for CUI content unless you are running inside such a boundary.

The gate is one question: Does this involve CUI? It does not auto-refuse — it asks, and lets you proceed only if you explicitly confirm an environment accredited for CUI. This skill gate is not an ITAR jurisdiction check, a classified-system check, or a § 126.18 retransfer check — those are handled elsewhere when relevant.

CUI — accredited environment

You may process CUI with ExChek when you can confirm all of the following about the environment you're running in:

  • The model runs inside an accredited boundary — an on-prem/air-gapped deployment, or a government/enterprise secure enclave (e.g. AWS GovCloud, Microsoft Azure Government, or equivalent) authorized for CUI. You are not relaying the content to a general-purpose public AI outside that boundary.
  • The controls are met — typically DFARS 252.204-7012 / NIST SP 800-171 / CMMC 2.0, often FedRAMP High or DoD Impact Level 4/5.
  • No training, retention, or external logging — the platform does not train on, retain, or log your data outside the accredited boundary (a zero-retention / no-training configuration).
  • No controlled content leaves the boundary — item descriptions, technical data, source code, and party names are not sent to external cloud endpoints, including the ExChek API at api.exchek.us and the Trade.gov CSL at data.trade.gov. Send only non-controlled tokens (CFR part numbers, generic search terms) to any external service; use on-prem regulatory data (below) for the rest.

When you confirm, the skill proceeds and records your attestation (environment, accreditation/impact level, who, when) in the report's AI Tool Usage & Currency Disclosure section. If you cannot confirm every point, use the on-prem setup below instead.

Privacy settings (all environments)

Even for non-CUI work, confirm your AI platform opts out of data collection and model training — preferably an enterprise tier that contractually does not train on or log usage. Minimum acceptable: disable model-training / improve-the-product toggles on a consumer tier. Free consumer tiers with training enabled are not acceptable for export-compliance work.

On-prem / air-gapped setup (fallback)

When you can't confirm a compliant secure enclave for CUI, run ExChek entirely inside your boundary with a local LLM. Do not configure the agent to use any external cloud API LLM when processing CUI.

  1. Obtain the skill files as an offline bundle — Download the ExChek skills as a ZIP (do not rely on live cloud sync) and transfer them to your environment via your organization's approved method (e.g. air-gapped media, secure transfer).
  2. Install locally — Unzip and place the skill in your local agent's skills directory (e.g. ~/.claude/skills/exchek-classify or the equivalent for your on-prem/enclave agent platform).
  3. Use an in-boundary LLM only — Run the agent that executes the ExChek skill against a local LLM hosted within your secure boundary. No external cloud or API LLM when processing CUI.

Getting the latest Part 774 and Part 121 in-boundary

The ExChek skill uses regulatory data from 15 CFR Part 774 (Commerce Control List, CCL) and 22 CFR Part 121 (United States Munitions List, USML). For on-prem or air-gapped use, you need to obtain the latest 774 and 121 data inside your environment so the local agent can use it without calling external cloud APIs.

Option 1: Run the ExChek refresh script in-boundary

If you have the ExChek API codebase in your environment (e.g., from the full ExChek repo or a released package), you can run the eCFR snapshot refresh script. It fetches the current title structures from eCFR (ecfr.gov), extracts Part 774 and Part 121, and writes them to local JSON files. No Supabase or cloud storage is required for local-only use.

  1. From the apps/api directory of the ExChek repo, ensure dependencies are installed (npm install).
  2. Run the refresh script:
node scripts/refresh-ecfr-snapshot.js

By default, the script writes ecfr-part-774.json and ecfr-part-121.json to apps/api/.data (or the directory set in ECFR_SNAPSHOT_DIR). Configure your in-boundary API or agent to read 774/121 from this directory so the skill can use the latest CCL and USML data without calling the public ExChek API.

Option 2: Fetch from eCFR and extract the parts

If you cannot run the ExChek script in-boundary, you can fetch the latest structure from eCFR and extract the parts manually:

  1. From a system that is allowed to reach eCFR (e.g., a boundary host), download the current title structures:
curl -o title-15.json "https://www.ecfr.gov/api/versioner/v1/structure/current/title-15.json"
curl -o title-22.json "https://www.ecfr.gov/api/versioner/v1/structure/current/title-22.json"
  1. Transfer title-15.json and title-22.json into your environment using your approved process.
  2. Extract the Part 774 subtree from title-15.json (the node whose identifier or label is Part 774) and save it as ecfr-part-774.json. Extract the Part 121 subtree from title-22.json and save it as ecfr-part-121.json.
  3. Place both JSON files in a directory your in-boundary agent or API can read, and point the skill or local API to that directory so classification uses this data instead of any cloud endpoint.

Run this process periodically (e.g., weekly) to refresh 774 and 121 when eCFR is updated.

Related