AI & 8140: where this stands
The DoD is pushing hard to adopt AI, and the natural question for anyone under an 8140 obligation is whether AI training is now part of it. Here is the honest, sourced answer — what is required, what is not, and how to use AI on government work without causing a problem.
8140 does not currently require any AI certification. No AI credential appears on any obtainable 8140 or 8570 baseline, and no Department-wide policy mandates AI training for the technical or IT workforce, or for contractors as such.
There is one narrow exception: personnel whose positions are coded into a DCWF Data/AI work role face a role-based qualification requirement, just as cyber roles face cyber qualification. If your billet is coded IT, Cybersecurity, or Software Engineering — a sysadmin, network engineer, or developer — you are not swept into that. Details below.
Is AI training required?
For the general technical workforce, no. Two sources make this concrete. The DoD-wide list of mandatory civilian training (published by DCPAS, October 2024) enumerates its required trainings — cybersecurity awareness, CUI, records management, and the rest — and none of them is AI. And the marquee federal statute on the subject, the AI Training Act of 2022, excludes the Department of Defense from its scope by name; even for the agencies it does cover, it targets the acquisition workforce, not technical staff.
"Encouraged and enabled" is not "required." The Department is fielding tools, writing guidance, and pushing adoption — but pushing adoption is not the same as mandating that each person hold an AI credential, and no memo, statute, or DoD manual we could source says it does. So if you are told AI certification is now part of your 8140 obligation the way Security+ is, that is not accurate for the general workforce.
Where a requirement is emerging: the DCWF Data/AI element
The one place AI qualification is becoming real is the DCWF's seventh element, Data/AI — the data scientists, AI/ML specialists, and AI test-and-evaluation roles. That element is being folded into the 8140 qualification program under the Foundational Qualification Matrix v2.1 (effective September 19, 2025). If your position is coded into a Data/AI work role, expect qualification requirements to apply to you the way they already do for cyber roles.
We deliberately do not publish a Data/AI-role-to-certification table here. At the time of writing, the specific per-role qualification options in the v2.1 matrix were not publicly verifiable — the authoritative file was behind CAC login — and inventing that mapping would be exactly the kind of confident guess this site refuses to make. What is sourced is the direction: Data/AI is a real, populated element, and it is moving from "defined" toward "qualified." The specifics are still rolling out.
The rule that actually matters: authorized data, authorized system
Whether or not AI is required, using it carelessly on government work is a real risk — and this is where a cleared professional needs different guidance than a generic AI course gives. The core rule is not new and it is not about AI: put only authorized data into a system authorized to hold it. Pasting controlled unclassified information (CUI) into a public consumer chatbot moves that data into a system authorized to hold nothing sensitive — a spill, under the existing CUI-safeguarding regime (DoD Instruction 5200.48 and the DFARS safeguarding clauses, notably 252.204-7012), not under some novel AI regulation. The Air Force made the point explicit for its acquisition workforce with DAFFARS Subpart 5339.73 on the use of large language models, effective October 2024, which points back to that same data-handling authority.
Authorized use runs on platforms assessed to an appropriate DoD impact level. As of December 2025, examples included GenAI.mil — the enterprise platform the CDAO launched on December 9, 2025, described as certified to Impact Level 5 (CUI) — and Ask Sage, a commercial platform that received a DISA IL5 provisional authorization in October 2024 and is positioned to cover the Defense Industrial Base. Treat those as dated examples, not a standing list: in the very same month, the Air Force announced that its widely used NIPRGPT would sunset on December 31, 2025. The roster turns over fast — which is why the durable skill is the rule, and why you confirm any platform's current authorization with your ISSM before relying on it.
Does AI study count toward my certification?
Often, yes — with a relevance catch. The major issuers accept AI-related professional development toward renewal: ISC2 for the CISSP (and it offers AI courses that award CPE), ISACA for CISM and CISA, and GIAC for its credentials. CompTIA is the strictest: at least half of a course's content must map to the exam objectives of the certification you are renewing, so generic AI training does not automatically earn Security+ units. The honest rule is that AI study can count when it is relevant to that certification's scope, and each issuer is the authority on whether a specific activity qualifies.
One precision worth stating: no training provider grants CPE or CEU credit — the certifying body does, under its own rules. What a course can honestly give you is a completion record you self-report; the issuer decides whether and how it counts.
The course: AI for the DoD Technical Workforce
Every AI course teaches you to be productive. Ours teaches you to be productive without causing a spill — what never goes in a prompt, the authorized-platform path, prompting and verifying without stepping over the line, and how AI study relates to the certification you already hold. It is professional development, not certification prep, and it is included in the same subscription as everything else.
See the courseAI is coming to Security+ itself
Separate from any DoD 8140 requirement, CompTIA’s draft Security+ SY0-801 objectives (document version 1.5, as of September 15, 2026) include objective 2.6 on threats and vulnerabilities of AI usage, such as prompt injection, poisoning, and jailbreaking, and list large language models as an attack surface. The objectives are a draft and can change before the exam launches.
Where this came from
Every claim on this page is sourced. AI policy and the approved-tools landscape move quickly — the tool status above is stamped as of December 2025 and should be re-verified against your organization's current guidance. Last reviewed July 22, 2026.
- DoD Civilian Mandatory Training Requirements (DCPAS, Oct 2024) — the Department-wide list of required trainings; it contains no AI requirement.
- AI Training Act, Public Law 117-207 (2022), §2(a)(5)(B) — excludes the Department of Defense from the Act's scope by name.
- DoD Instruction 5200.48 and DFARS 252.204-7012 — the CUI-safeguarding regime that makes putting controlled data in an unauthorized system a reportable disclosure.
- DAFFARS Subpart 5339.73 (effective Oct 16, 2024) — Air Force acquisition rule on the use of large language models, pointing back to the CUI regime.
- DoD 8140 Foundational Qualification Matrix v2.1 (effective Sep 19, 2025) — folds the DCWF Data/AI element into the qualification program; specific per-role options were not publicly verifiable at review time (CAC-gated).
- Issuer continuing-education policies — CompTIA, ISC2, ISACA, GIAC — each accepts relevant professional development toward renewal under its own relevance rules; CompTIA requires content to map to the certification's objectives.