Roundups
Which AI coding tools are FedRAMP authorized?
Short answer
2 of the 6 AI coding tool setups we track have a FedRAMP authorization on record: Kiro (AI coding IDE) in AWS GovCloud (High) and Codex (desktop app and CLI) signed in to a FedRAMP workspace (Moderate). Only Kiro (AI coding IDE) in AWS GovCloud also has a published DoD IL5 listing.
Of the 6 coding tool setups we track, 2 are FedRAMP authorized (Kiro (AI coding IDE) in AWS GovCloud: High; Codex (desktop app and CLI) signed in to a FedRAMP workspace: Moderate), 2 are in process (Claude Code with a commercial Claude plan and Cursor) and 2 are not authorized (GitHub Copilot Business and Enterprise and Codex with a commercial ChatGPT plan).
For tools like Claude Code and Codex, the boundary is set by what the tool signs in to, not by the tool itself. The table shows each setup separately.
Generated from our dataset. Sources last re-checked Oct 17, 2026.
The sourced table
| AI offering | FedRAMP | DoD IL | Can I use it with CUI? | Source |
|---|---|---|---|---|
| Kiro (AI coding IDE) in AWS GovCloud | IL2, IL4, IL5 (GovCloud) | Yes, with conditions | aws.amazon.com | |
| Codex (desktop app and CLI) signed in to a FedRAMP workspace | Not established | Yes, with conditions | fedramp.gov | |
| Claude Code with a commercial Claude plan | In Process | Not established | Only in a separate environment | fedramp.gov |
| Cursor | In Process | Not established | No | fedramp.gov |
| GitHub Copilot Business and Enterprise | Not listed | Not established | No | fedramp.gov |
| Codex with a commercial ChatGPT plan | Not listed | Not established | Only in a separate environment | help.openai.com |
Every row links to its primary source and full page. Statuses change; open the source before you decide. How we verify.
Related questions
Is Cursor FedRAMP authorized?
Marketplace: FedRAMP In Process, 20x, Program path. Cursor is listed as FedRAMP In Process, not certified. Until a certification is published, there is no FedRAMP record covering CUI in Cursor's cloud.
Is Claude Code FedRAMP authorized?
Claude Code on a Pro, Max, Team or Enterprise plan uses Anthropic's commercial service. Anthropic offers two CUI paths: Claude Code inside the Claude for Government desktop app, or Claude Code pointed at Bedrock GovCloud or Vertex, where it 'follows your region'.
Is Codex FedRAMP authorized?
Covered when used with a FedRAMP ChatGPT workspace or a FedRAMP-enabled API organization. Requires desktop app 26.1002.51308+ or Codex CLI 0.162.0+. Admins enable Codex Local access in the FedRAMP workspace.
Is GitHub Copilot FedRAMP authorized?
GitHub Enterprise Cloud is Certified at Class B (Low/LI-SaaS); GitHub says Copilot itself is not yet authorized.
Is Kiro FedRAMP authorized?
AWS lists Kiro as FedRAMP Class C (East/West) and Class D (GovCloud). AWS's services-in-scope pages list Kiro in GovCloud's FedRAMP High boundary and for DoD IL2, IL4 and IL5 in GovCloud.
Not legal advice. These answers describe what public authorization records and vendor documentation say, not whether your contract, data or configuration is compliant. Confirm with your contracting officer, assessor or counsel.
More questions
Get status changes by email
One short email when an AI tool's FedRAMP, Impact Level or OneGov status changes. No spam, unsubscribe anytime. See our privacy page.