Can AI read our Costpoint data without creating a DCAA problem?
The rules don't mention AI. They describe an accounting system and the records behind every number you submit, and that tells you exactly where the lines are.
The short answer: yes, as long as the AI only reads and every number it produces can be traced back to your books. The clauses that govern contractor accounting systems and records do not mention AI (as of October 12, 2026). They ask whether your system is reliable and whether you can support what you bill, propose and claim. So the safe pattern is read-only access, Costpoint permissions carried into every answer, a source on every figure, and a log you keep like any other record. People still post, approve and sign.
For a controller, "AI" and "Costpoint" in the same sentence tends to raise one worry before any other: what will the auditors make of it? It is a fair worry. Costpoint is the system of record for every rate you bill, every hour you charge and every number in your incurred cost submission. Nobody wants to explain a chatbot at the next audit.
The good news is that the rules are specific about what they care about, and none of it is the brand of software sitting next to your ERP. Read closely, they draw four clear lines.
The clause describes a system, not a software list
For DoD contracts that carry it, DFARS 252.242-7006 (January 2025) defines an acceptable accounting system as one that gives reasonable assurance that "the accounting system and cost data are reliable" and that the "risk of misallocations and mischarges" is minimized. It then lists 18 criteria. A handful decide most AI questions:
- "Accumulation of costs under general ledger control."
- "Approval and documentation of adjusting entries."
- Cost information that lets you "readily calculate indirect cost rates from the books of accounts."
- "Billings that can be reconciled to the cost accounts for both current and cumulative amounts claimed."
- "Adequate, reliable data for use in pricing follow-on acquisitions."
The stakes are real. Under DFARS 252.242-7005, a material weakness in a contractor business system can lead the contracting officer to withhold 5 percent of payments, and up to 10 percent when more than one system is affected. A controller who hesitates is doing the job.
Reading the books is not the risk. Writing to them is.
An assistant that reads Costpoint changes nothing in the general ledger. One that posts, adjusts or reclassifies lands squarely inside "approval and documentation of adjusting entries," and now you have a second, less controlled path into the books.
Costpoint lets you keep the line clean. Deltek's cloud offers read-only database access through its Hybrid Data Pipeline driver, requested by the customer's own administrator. Web services are off by default: Deltek's integration overview states that "by default, Costpoint users do not have rights to access integration," and an administrator grants it user by user. On premises, read access is entirely the customer's decision.
The rule that follows is simple: AI drafts, flags and answers. People post, approve and sign. The same goes for labor. The clause expects a timekeeping system that ties each employee's hours to the right cost objective and a labor distribution that charges them correctly. An assistant can remind someone that a timesheet is missing or flag a charge code that looks wrong. The employee still records and certifies their own time.
The risk is the number that leaves the building
Most AI questions stay inside the company. "What is our year-to-date G&A rate against provisional?" "Which projects are past 75 percent of funded value?" Those answers inform decisions, and a wrong one costs you time.
The trouble starts when one of those answers ends up in an invoice, a pricing proposal or the incurred cost submission. The clause expects billings that reconcile to the cost accounts and rates you can calculate from the books. A figure that came from an AI summary, and that nobody can trace to a Costpoint report, is a figure you cannot support.
So every answer has to carry its source: which report or table, which period, which filters, and when the data was pulled. If the assistant cannot show where a number came from, it should not show the number. When the data is not there, it should say so instead of estimating. This is the same discipline a good staff accountant already follows, applied to software.
AI output can become a record
This line is easy to miss. FAR 52.215-2 defines records broadly: "books, documents, accounting procedures and practices, and other data, regardless of type," including data "in the form of computer data." They must stay available until 3 years after final payment. FAR 4.703 adds that computer data must be kept "on a reliable medium" and that contractors "shall not destroy, discard, delete, or write over such computer data" during the retention period.
A practical reading, not legal advice: if an AI-produced analysis supports a cost you claim or a price you propose, treat it like a workpaper. Keep the output, the sources it used and the log of who asked what. Decide the retention policy before go-live, with your counsel and your auditors. And remember that an AI vendor's default retention period is not your retention policy. Many commercial services delete prompts and outputs on their own schedule, so the record copy needs to live in a system you control.
Permissions have to survive the trip
Costpoint's role security already decides who sees salaries, indirect rate detail and project margins. An assistant connected through one powerful service account flattens all of that: anyone who can ask a question can see the answer. That is a confidentiality problem, and it sits poorly with the clause's first criterion, "a sound internal control environment."
A serious build answers each person only from what their own Costpoint access allows, and records who it answered. It is unglamorous work, and it is the difference between a pilot and an incident. The broader version of this problem is covered in how to build AI solutions with your company's own data.
Where Deltek's own AI fits
Deltek is moving in the same direction. Its Costpoint 2026.1 release (January 2026) added custom AI agents and describes them as "capturing AI reasoning, timestamps, and confidence levels on each transaction" while "preserving governance and auditability." That is the right standard, and it should apply to any AI that touches Costpoint data, Deltek's or anyone else's.
Two gaps remain. Deltek's Dela FAQ states that Dela "currently is not available in Deltek's GCCM Cloud offering," the environment many contractors handling CUI use. And Dela works inside Deltek's products, so questions that span Costpoint, GovWin IQ, spreadsheets and contract files fall outside it. Firm-specific work in those gaps has to meet the same audit standard, not a looser one.
Settle five things before you connect anything
- Read only. The AI has no path to post, adjust or approve anything in Costpoint.
- Inherited permissions. Each person sees only what their Costpoint role already allows.
- A source on every figure. Report, period, filters and pull date, or no number at all.
- A log you keep. Who asked, what was asked, what was used and what was answered, retained in your own systems.
- Classify the data. Indirect rates and payroll are sensitive but usually not CUI. Contract documents and technical data may be, and they change where the AI can run. (More on that line in Is it safe to put CUI or contract documents into ChatGPT or Copilot?)
Get those right and the auditor's question, "how was this number produced?", has a short answer with a document behind it. That is what the rules ask for.
Common questions
Is there a DCAA rule about contractors using AI?
Not in the clauses that govern contractor accounting systems and records. As of October 12, 2026, DFARS 252.242-7006, DFARS 252.242-7005, FAR 52.215-2 and FAR 4.703 do not mention AI. Their expectations apply whatever software produced a number.
Do AI conversations count as records we have to keep?
They can. The FAR's definition of records includes computer data, and retention usually runs to 3 years after final payment. If an AI analysis supports a cost you claim or a price you propose, keep it and its sources like any other workpaper, and confirm the policy with counsel.
Can an AI assistant enter timesheets or post journal entries in Costpoint?
It should not. An assistant can remind, draft and flag. Employees record their own time, and people post, approve and sign.
Is Costpoint data CUI?
Rates, payroll, billing and project financials are sensitive business data but usually not CUI. Contract documents and technical data stored alongside them may be. Classify the specific data before choosing where an AI tool runs.