Customer Drawings, Pricing and ITAR: How to Set AI Rules in a Small Manufacturer's Office

Why this comes before any AI tool

Your office handles three kinds of information that AI tools can touch: everyday order data, customer confidential material and, in some shops, export-controlled technical data. Each needs a different rule. Getting it wrong can cost you a customer, or worse.

This post is a practical starting point, not legal advice. Your export compliance lead and your attorney make the final calls.

Sort your data into three buckets

Bucket 1: Everyday order data

Purchase order (PO) numbers, quantities, ship dates, addresses and standard prices. This is usually fine to process with a business-grade AI tool, as long as the account is set so your data is not used for training (where the vendor offers that setting) and access is limited to the people who need it.

Bucket 2: Customer confidential material

Drawings, specifications, special pricing and anything covered by a nondisclosure agreement (NDA) or a customer's supplier terms. Read those terms. Some customers restrict where their files can be stored or who can see them. If a contract says files cannot leave approved systems, your AI setup has to respect that. In practice, that may mean the AI reads the PO text but never opens the attached drawing.

Bucket 3: Export-controlled technical data

If you make defense articles or parts for them, some of your drawings may be technical data under the International Traffic in Arms Regulations (ITAR), which the State Department publishes in Title 22 of the Code of Federal Regulations (CFR), Subchapter M. Sharing that data with the wrong person, or storing it in the wrong place, can count as an export.

The ITAR does carve out one storage case. Under 22 CFR 120.54(a)(5) (eCFR, current as of Oct 2026), sending, taking or storing technical data is not an export if the data is:

• unclassified;
• secured using end-to-end encryption;
• secured with cryptographic modules compliant with Federal Information Processing Standards (FIPS) 140-2 or its successors, with key management and procedures that follow current National Institute of Standards and Technology (NIST) guidance, or by other cryptographic means at least comparable to 128-bit Advanced Encryption Standard (AES-128) strength;
• not intentionally sent to a person in, or stored in, a country listed in §126.1; and
• not sent from a country listed in §126.1.

Whether a particular AI service meets those conditions is a question for your compliance lead, not for an AI consultant or a sales rep. Our default rule: ITAR-controlled drawings stay out of AI tools unless your compliance lead has approved the specific setup in writing.

Other export rules may apply to your products too. If you are not sure whether you hold controlled data, find out before you connect any AI tool to your file shares.

A one-page AI rule sheet you can adapt

Most small manufacturers don't need a 20-page policy. They need one page people actually read. Here is a starting structure:

1. Approved tools. List the AI tools staff may use for work, and on which accounts. Personal accounts are not allowed for company data.
2. Account settings. Business accounts only, with training on your data turned off where the vendor offers it. Name who checks this and how often.
3. What can go in. Bucket 1, yes. Bucket 2, only in approved workflows that respect customer terms. Bucket 3, never, unless your compliance lead approves in writing.
4. What needs a human check before it goes out. Every quote, acknowledgment, price, ship date and customer email.
5. Where data goes. A short list of every system an AI workflow reads from or writes to. Update it whenever you add one.
6. Customer restrictions. A list of customers whose contracts limit file handling, and what each limit is.
7. Who to ask. One named person for questions, and a way to report a mistake without blame.
8. Review date. Revisit every six months, or whenever you add a tool.

Build the approvals into the workflow

Rules on paper don't help if the software lets people skip them. When Lunan sets up front-office AI, the approvals are part of the design:

• AI drafts land in a review queue, not in your enterprise resource planning (ERP) system or a customer's inbox.
• Lines that don't match the quote are flagged and cannot be approved without a decision.
• Attachments from customers on the restricted list are skipped or routed to a person.
• Every approval is logged with who approved it and when.

This is the same pattern described in customer purchase orders to sales orders: AI drafts, a person decides.

Questions to ask any AI vendor

• Is our data used to train your models? Can that be turned off, and is it off by default?
• Where is our data stored, and in which countries?
• Who at your company can see it?
• How long do you keep it, and can we delete it?
• What encryption do you use in storage and in transit? (Your compliance lead will want this if Bucket 3 is ever in scope.)
• Can we get a written list of the other companies (subprocessors) that handle our data?

Get the answers in writing. If a vendor can't answer, that is your answer.

Train the people, not just the software

Most problems start with a well-meaning employee pasting a drawing into a free chatbot to ask a quick question. A short session covering the three buckets and your rule sheet prevents most of it. Make it specific: show real examples of each bucket from your own paperwork, and show the approved way to do the same task.

This matters more than it sounds. The National Association of Manufacturers' Q2 2026 survey (Jun 2026) found that among manufacturers training frontline workers on AI, 78.5% keep it at the introductory or awareness level. Awareness is a fine start, but office staff also need to know what is allowed with customer data.

Next step

Lunan's free conversation includes a quick look at which of your front-office data falls into each bucket and what that means for any AI setup. You get a short written summary either way. For the broader picture, start with our front-office guide.