The Levels Nobody Outside Defense Tech Understands
News stories about the May 1 Pentagon AI deals keep mentioning "Impact Level 6 and 7" without explaining what that means. Most readers nod and move on. Most reporters do not actually know.
Impact Levels are the Department of Defense's classification system for cloud and AI services. They determine what kind of data a vendor is allowed to handle, what security controls they need to operate, and what consequences exist if data is compromised.
Eight companies just cleared the highest two tiers. That is the largest single expansion of commercial AI access to classified military environments in US history. Here is what each level actually involves.
The Six Impact Levels
Impact Level 2 (IL2): Public data and low-confidentiality information. Most commercial cloud services qualify with minimal additional controls. AWS, Azure, Google Cloud all operate at IL2 by default.
Impact Level 4 (IL4): Controlled Unclassified Information. Includes Personally Identifiable Information of military personnel, contract data, and most internal DoD operational information. Requires US-citizen-only personnel and dedicated infrastructure.
Impact Level 5 (IL5): Higher-sensitivity Controlled Unclassified Information. Includes National Security Systems data and FOIA-exempt information. Requires more rigorous personnel screening and isolated network paths.
Impact Level 6 (IL6): Classified information up to and including Secret. Mission planning data, Secret-classified intelligence reports, weapons systems specifications. Requires SCIF-level physical security at data centers, full personnel security clearances, and air-gapped network configurations.
Impact Level 7 (IL7): Top Secret information including Sensitive Compartmented Information (SCI). Source intelligence, signals intelligence, special access programs. Requires the highest level of facility security, compartmented access controls, and isolation from any commercial network.
Impact Level 8 (IL8): Top Secret/SCI with additional access controls for the most sensitive intelligence programs. Operated by a much smaller set of vendors with even tighter restrictions.
What Operating at IL6/IL7 Actually Requires
Cleared vendors must meet requirements that exceed normal enterprise security by orders of magnitude:
1. Physical security. Data centers must meet Sensitive Compartmented Information Facility (SCIF) standards. That includes electromagnetic shielding (TEMPEST), 24/7 armed guards, multiple layers of biometric access controls, and inspection of every person and item entering the facility.
2. Personnel security. Every person with access to IL6/IL7 systems must hold an active Secret or Top Secret clearance. Background investigations take 6-18 months. Continuous evaluation requires periodic reinvestigation and adjudication.
3. Network isolation. IL6 systems must be air-gapped from commercial networks. IL7 systems must be air-gapped from each other when handling different compartments. Data movement requires manual cross-domain transfer with approval at each step.
4. Hardware controls. Hardware must be sourced from approved supply chains. Components from "untrusted" countries (China, Russia, Iran, North Korea, others) are prohibited. The supply chain audit is continuous.
5. Audit logging. Every access, every query, every model output must be logged with cryptographic integrity. Logs are reviewed by both vendor security teams and government auditors.
6. Incident response. Any potential compromise triggers immediate disconnection, forensic analysis, and damage assessment by both the vendor and the National Security Agency.
What AI at IL6/IL7 Looks Like in Practice
Commercial AI products like ChatGPT or Gemini operate on shared infrastructure where data from many customers transits the same servers. That is impossible at IL6/IL7. Pentagon AI deployments require:
Dedicated model instances. The model weights and inference infrastructure are physically isolated from any commercial deployment. The Claude or GPT-5 running for the Pentagon is a separate copy from what Anthropic or OpenAI customers use.
Air-gapped training data. If models are fine-tuned on classified data, that fine-tuned model cannot leave the IL6/IL7 environment. The base models can be brought in. The customized versions cannot leave.
Compartmented access. Different DoD users may have access to different model variants based on their clearance level and need-to-know. The same query from two analysts might return different results based on what each is authorized to see.
Output monitoring. Model outputs are themselves classified at the appropriate level. A prompt that returns Top Secret information cannot be exported to a Secret-level system.
Why This Matters for the Vendors
The eight companies that just cleared IL6/IL7 have a structural moat. Operating at this level requires physical infrastructure investments most companies cannot make, personnel pipelines most companies cannot build, and approval processes that take years.
Once cleared, vendors have access to a procurement environment where the federal government will pay premium prices for AI services that other customers cannot legally receive. That is the highest-margin enterprise market in the world.
Anthropic's exclusion is not just about losing one contract. It is about being shut out of an entire vertical that requires years of clearance work to enter. Even if Anthropic resolves their dispute with the Trump administration, the multi-year clearance process means they will be 18-36 months behind the eight cleared vendors.
What This Means for AI Pricing
Defense contracts at IL6/IL7 typically command 3-10x the per-token cost of commercial AI products. Premium for security controls, premium for compliance, premium for clearance overhead, premium for the limited number of qualified vendors.
OpenAI, Google, Microsoft, AWS, Nvidia, SpaceX, Reflection, and Oracle just locked in revenue streams that will compound for the next decade. Even if commercial AI prices race to zero through competition, defense AI prices will hold premium pricing because there are only eight vendors who can serve the market.
The Broader Context
If you want the long-form history of how the US national security state arrived at this moment — DARPA, the post-9/11 reorganization, the integration of commercial tech into classified workflows — there is one definitive book on the subject. The Pentagon's Brain by Annie Jacobsen traces the entire institutional history. It explains why eight companies cleared IL6/IL7 was the inevitable endpoint of trends that started with the Defense Advanced Research Projects Agency in the 1950s.
It is the context that turns "the Pentagon signed AI deals" into "the Pentagon completed a 70-year project of integrating commercial technology into national security infrastructure."
The Bottom Line
Impact Level 6 and 7 are the highest bars in commercial cloud and AI. Eight companies just cleared them simultaneously. That has never happened before.
The implications cascade through the AI industry, the defense sector, and the broader question of how commercial technology gets integrated into the national security state. Most of those implications will play out over the next decade rather than the next quarter.
For now: understand what just happened. Eight companies got cleared to deploy AI on the most sensitive networks in the United States military. One company refused to participate in mass surveillance applications and was excluded. The procurement environment of the next decade is being defined right now.
