Precision Components Vermont

\\n\\n \\n \\n\\n \\n\\n

---

\\n\\n \\n

Section 1 — Company Profile & Scope

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Field	Detail
Company	Precision Components Vermont (fictional profile — illustrative only)
Headcount	320 employees: CNC machinists (140), QA technicians (28), engineers (42), programmers (18), sales & customer support (24), finance & admin (20), management (12), maintenance (16), logistics (20)
Revenue	$85M (FY2025); YoY growth 8%
Product Mix	Aerospace structural components (~45%), medical device precision parts (~30%), semiconductor equipment components (~15%), defense subcontracting (~10%)
Key Customers (OEMs)	Lockheed Martin, Raytheon, Medtronic, Boston Scientific, Applied Materials — all under strict NDAs and quality agreements
Certifications	AS9100D (aerospace), ISO 13485 (medical devices), ITAR registration, Nadcap accreditation
IT Infrastructure	On-premise file servers; Microsoft 365 E3; ERP (JobBOSS); CMM inspection software; SharePoint for document control; no AI tools formally deployed
Current AI Usage	Personal ChatGPT/Gemini accounts across engineering and programming teams; no formal AI governance; no approved AI tools
Key Vulnerability	14 senior machinists/process engineers age 57+ eligible for retirement within 24 months — tribal knowledge at risk

\\n\\n

---

\\n\\n \\n

Section 2 — Current State Inventory

\\n

AI tools currently in use — all outside IT visibility, none approved through formal procurement or security review.

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Tool	Deployment Type	Users	Volume Estimate	Risk Flag
ChatGPT (free, personal accounts)	Consumer web — no enterprise controls	~55 employees (engineers, programmers, QA)	200–400 queries/day estimated; CAD spec descriptions, process parameters, inspection criteria commonly pasted	CRITICAL — ITAR-controlled data, customer specs, supplier NDA IP
Google Gemini (personal accounts)	Consumer web	~25 employees (engineers, programmers)	80–120 queries/day; CNC code review and optimization queries	CRITICAL — Same ITAR exposure as ChatGPT; no visibility
Microsoft 365 Copilot	M365 E3 tenant — no formal rollout	~8 engineers (informal trial)	Low — limited awareness of Copilot availability	HIGH — M365 data includes SharePoint engineering docs
CAD software built-in AI (Siemens NX, Mastercam)	Licensed on-premise	42 engineers, 18 programmers	Moderate — AI features used within CAD environment	MODERATE — Vendor AI; not ITAR exposure but unvetted
JobBOSS ERP AI features	Licensed SaaS	Production planners, sales	Low — scheduling optimization features	HIGH — Production data, job routing, customer PO data in cloud system
Quality inspection software (PC-DMIS AI)	Licensed on-premise	28 QA technicians	Moderate — defect classification AI in CMM software	MODERATE — Vendor-controlled; part of Nadcap compliance

\\n\\n \\n\\n

---

\\n\\n \\n

Section 3 — Data Sensitivity Map

\\n

Classification of data types by department, with AI tools currently touching each classification. This map forms the foundation for ITAR compliance documentation and supplier NDA governance.

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Department	Data Types	AI Tools Touching This Data	Classification	Volume/Week
Engineering / Programming	CAD files (.prt, .sldprt, .dxf), process plans, CNC programs (G-code), tolerance specifications, material specs, drawing revisions, ITAR-controlled program documentation	ChatGPT (personal), Gemini (personal), M365 Copilot (informal)	CRITICAL — ITAR-controlled export-controlled data / Arms Export Control Act	~800 part programs/week; ~60 contain ITAR-controlled data
Quality Assurance	CMM inspection programs, first article inspection reports (FAIR), AS9102 forms, PPAP documentation, customer quality requirements, nonconformance reports, supplier corrective action requests	ChatGPT (personal), Gemini (personal)	HIGH — Customer quality specs under NDA; medical device traceability requirements (ISO 13485)	~120 FAIRs/month; 40+ SCARs/month
Supply Chain / Purchasing	Supplier quotes (with proprietary process data), RFQ packages, material lead times, tooling specs, supplier capacity data, NDA-covered supplier technical packages	ChatGPT (personal)	CRITICAL — Supplier NDA IP; trade secret exposure; customer drawing data in supplier quotes	~200 RFQ responses/month; 85+ supplier relationships
Sales & Customer Support	Customer OEM specifications, program pricing, quote history, delivery schedules, customer NDA-covered technical packages	ChatGPT (personal), JobBOSS ERP AI	HIGH — OEM customer specs; NDA-covered program data; competitive quote information	~50 active customer programs; 15+ active NDAs
Production / Operations	Job routing, setup sheets, production counts, defect rates, machine utilization data, tribal knowledge (setup parameters, tooling preferences, material behaviors)	None formally; tacit knowledge in senior machinist heads	HIGH — Proprietary process knowledge; competitive manufacturing intelligence; at risk of loss via retirement	Tacit knowledge of 14 senior employees; no formal documentation
HR & Admin	Employee records, payroll, benefits, skills matrix, training records, succession planning data	ChatGPT (personal — HR generalist)	MODERATE — PII; skills matrix is proprietary	Low volume; HR generalist only

\\n\\n

ITAR / Export Control Compliance Gap

\\n

International Traffic in Arms Regulations (ITAR) restricts the export of defense articles, technical data, and services. Key findings:

\\n

\\n
• Engineering data is ITAR-controlled. Drawings, specifications, CNC programs, and process plans for defense subcontracts are export-controlled defense articles (USML categories). Transmitting them to a foreign-owned AI vendor (OpenAI, Google) without a valid export license may constitute a violation.
\\n
• No ITAR review of AI tool usage. The company has no ITAR compliance program that covers AI tool usage by engineers. No export classification review has been conducted on AI outputs.
\\n
• ITAR registration does not equal compliance. Being ITAR-registered (DTC registered) is the minimum. Active compliance programs for data handling are required.
\\n
• Defense customer flow-down clauses. Lockheed Martin and Raytheon subcontracts include ITAR compliance flow-down clauses. A violation could result in contract termination and customer debarment — worse than the regulatory penalty.
\\n

\\n\\n \\n\\n

---

\\n\\n \\n

Section 4 — Exposure Scenarios

\\n\\n \\n \\n\\n \\n \\n\\n \\n \\n\\n

---

\\n\\n \\n

Section 5 — Recommended Architecture

\\n

On-premises deployment is mandatory — ITAR and supplier NDA requirements prohibit any cloud-based AI infrastructure that would transmit controlled data outside the company's network perimeter. Three capabilities are recommended across two phases.

\\n\\n \\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Component	Description	Implementation
On-Prem GPU Server	Dedicated GPU server (on-premise or in company's own data center closet) running Llama 3.1 70B. No external API calls. Air-gapped from internet. Full ITAR isolation — no data leaves the network perimeter under any circumstance.	On-premise NVIDIA GPU cluster (A100 or H100); Llama 3.1 70B fine-tuned; VPN-locked access; ITAR compliance boundary established
Production Knowledge Assistant	Q&A interface against all documented and captured production knowledge — setup parameters, tooling preferences, material behaviors, job-specific notes. Also used to capture tacit knowledge from senior machinists during Phase 1 onboarding. \\\"Ask the 28-year veteran\\\" becomes possible.	Fine-tuned on job history, setup sheets, tooling logs, process plans; RAG against tribal knowledge capture interviews conducted in Phase 1; structured prompts for machinist knowledge capture sessions
Supplier Document Q&A Agent	Natural language Q&A against the full supplier document library — RFQs, quotes, technical specs. NDA compliance filter active: if a query would surface data from a document with an active NDA restriction, the system flags it and blocks the response. Supplier IP never leaves the system.	RAG against supplier document store; NDA metadata tag on each document; compliance filter layer rejects queries that would disclose NDA-protected data; audit log of all supplier document queries
Quality Records Search	Natural language search across CMM inspection data, FAIR history, NCR log, and SCAR database. Engineer asks: \\\"Show me all NCRs for aluminum 7075-T6 in the last 18 months\\\" — gets structured results from the actual quality database, not from memory.	RAG against quality records database; structured data ingestion from PC-DMIS and AS9102 forms; search results include part number, material, defect type, disposition, and cost
Tribal Knowledge Capture Program	Structured process for capturing tacit knowledge from senior machinists — not just the AI system, but a cultural program to document what the 14 retirement-eligible employees know. Interview protocol, knowledge mapping sessions, and systematic capture into the production knowledge store.	Conducted by VAS team in Phase 1; structured interview framework; knowledge mapped to job sequences; updates to production knowledge assistant with each capture session

\\n\\n \\n\\n

---

\\n\\n \\n

Section 6 — Phased Roadmap

\\n\\n \\n \\n\\n \\n \\n\\n \\n \\n\\n

---

\\n\\n \\n

Section 7 — Investment Estimate

\\n\\n

AI Readiness Assessment

\\n

Already completed for this fictional firm profile as part of the sample illustration.

\\n \\n \\n \\n \\n

Item	Amount
AI Readiness Assessment — full engagement	$7,500
Total Assessment	$7,500

\\n\\n

Private AI Build — Itemized Estimate

\\n

The $48K fixed-price covers on-premises deployment (mandatory for ITAR), three AI capabilities, tribal knowledge capture program, and ITAR compliance documentation. On-prem hardware costs are included (the GPU server is a material line item — cloud alternatives are not available given ITAR constraints).

\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Component	Amount	Notes
On-prem GPU server (hardware procurement, setup, networking)	$12,000	Including ITAR-compliant network isolation setup
Architecture design & ITAR compliance program	$7,000	ITAR export classification, compliance documentation, vendor review
Tribal knowledge capture program (14 employees, structured interviews)	$6,000	Interview protocol, knowledge mapping, documentation, Phase 1 upload
Production knowledge assistant — fine-tune + RAG + interface	$9,000	Llama 3.1 fine-tune on job history; RAG against setup sheets and tribal knowledge
Supplier document Q&A agent — RAG + NDA compliance filter	$6,500	NDA metadata tagging; compliance filter; audit log
Quality records search — data ingestion + RAG + interface	$5,500	PC-DMIS data ingestion; FAIR/NCR/CMM history search
Testing, QA, ITAR compliance audit	$5,000	Penetration testing of on-prem network; ITAR compliance validation; QA workflow testing
Project management & staff training	$4,000	Engineering team, purchasing team, QA team training; policy documentation
Net Build Cost	$55,000
Discount (assessment credit + on-prem efficiency)	($7,000)
Final Build Cost	$48,000

\\n\\n

Operations Retainer

\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Item	Monthly	Annual
System monitoring and GPU server maintenance	$1,500	$18,000
Quarterly model retraining (production knowledge updates)	$900	$10,800
New tribal knowledge capture sessions (ongoing)	$700	$8,400
Security patch management and vulnerability scanning	$500	$6,000
Supplier NDA compliance monitoring	$400	$4,800
Direct support for engineering/QA team questions	$500	$6,000
Operations Retainer	$4,500	$54,000

\\n\\n \\n\\n

---

\\n\\n \\n

Section 8 — Vendor Comparison

\\n

Three-path analysis: On-Prem Private AI Build (mandatory for ITAR compliance) vs. cloud-based alternatives that cannot be used.

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Criteria	On-Prem Private AI Build Recommended — Required	Microsoft Azure OpenAI (云)	Standard Cloud AI Tools
ITAR compliance	✓ Full isolation — data never leaves the facility	✗ Azure-hosted; ITAR-controlled data cannot be transmitted	✗ No cloud option meets ITAR requirements without specific export license
Supplier NDA data handling	✓ NDA compliance filter; no third-party data disclosure	✗ Data processed by Microsoft; NDA compliance uncertain	✗ No cloud vendor guarantees against data disclosure to third parties
Tribal knowledge capture	✓ Structured program to capture and preserve tacit knowledge	✗ Cloud tools don't capture tribal knowledge — they just answer questions	✗ Same — no knowledge capture program
CAD/process data fine-tuning	✓ Fine-tuned on company's own job history and process data	⚠ Could technically fine-tune on process data, but ITAR violation	✗ Not designed for manufacturing process data
Quality records search	✓ RAG against CMM data, FAIRs, NCRs — all on-prem	⚠ Technically possible but ITAR/quality data risk	✗ Not designed for manufacturing quality data
Medical device (ISO 13485) compliance	✓ Audit trail, documented process, full traceability	⚠ Audit trail available but supplier data in Microsoft cloud is compliance risk	✗ No ISO 13485 compliance design for AI systems
Aerospace (AS9100D) compliance	✓ Documented AI usage; ITAR compliance documentation included	⚠ ITAR prevents use of cloud AI with controlled data	✗ ITAR prevents use
Year 1 cost	$109,500 (assessment + build + retainer)	Prohibited by ITAR	Prohibited by ITAR
Year 2+ ongoing cost	$54,000/yr (retainer + server maintenance)	N/A	N/A
IP ownership	✓ Company owns model weights and all data on-premises	✗ Microsoft owns the model; no IP	✗ Vendor owns model

\\n\\n \\n\\n

---

\\n\\n \\n

Section 9 — Next Steps

\\n\\n \\n\\n \\n\\n