Azure FedRAMP Moderate and CJIS Coverage for AI Transcription Services — Clarification Needed

Thank you for reaching out regarding the compliance status of these specific Azure AI models. I understand you are seeking definitive clarification on whether MAI-Transcribe-2 (via Speech Fast Transcription) and Microsoft-Decision-1 are covered under FedRAMP Moderate and CJIS Security Policy boundaries for production use.

The direct answer is that neither of these specific model offerings is currently certified or approved for production processing of FedRAMP Moderate or CJIS-regulated workloads (such as Criminal Justice Information / CJI).

Here is the technical breakdown of why these models do not currently meet these compliance scopes, along with recommended next steps:

1. MAI-Transcribe-2 (Azure Speech Fast Transcription)

• Preview Status: MAI-Transcribe-2 is currently in Public Preview via the Fast Transcription API's enhancedMode.
• Compliance Impact: Under Microsoft’s Supplemental Terms of Use for Azure Previews, preview features are provided "as-is" without Service Level Agreements (SLAs). Crucially, public previews do not inherit the parent platform’s compliance certifications (such as Azure Speech’s FedRAMP High P-ATO or CJIS agreements).
• Azure Government Availability: Because it is a preview feature, it is not fully deployed or priced in the Azure Government cloud environment.

2. Microsoft-Decision-1 (Microsoft Foundry)

• Environment Limits: Microsoft-Decision-1 is deployed through Microsoft Foundry and is not currently listed in the Azure Government catalog.
• Compliance Boundary: While Microsoft Foundry supports "Data Zone Sovereignty" (DataZoneStandard) to restrict data to specific geographic boundaries (like the US), this is a data residency feature and is not a substitute for a formally audited FedRAMP boundary or CJIS-screened environment.

3. CJIS Policy (v6.0) Considerations

• Personnel Screening: Azure Government operations personnel undergo physical, fingerprint-based FBI background checks to align with standard CJIS Management Agreements. Standard Azure Commercial personnel do not.
• In-Memory Inference Processing: Under CJIS Security Policy v6.0, using Azure Commercial for CJI requires the customer to maintain sole custody of the encryption keys (Customer-Managed Keys). Because these models must decrypt the data (audio files or JSON states) in-memory to perform transcription or decision-scoring, sending unencrypted CJI to a model that sits outside of a certified, audited boundary violates CJIS requirements.

Recommended Next Steps

1. Restrict Regulated Data: Do not use production CJI or FedRAMP-scoped data with MAI-Transcribe-2 or Microsoft-Decision-1 while they remain in preview or outside of the government boundary. Use synthetic or non-regulated test data for your evaluations.
2. Verify Against Official Compliance Scope: Monitor the Microsoft Azure Services in Scope documentation. Once these models transition to General Availability (GA) and are audited, they will be officially listed in the FedRAMP and CJIS audit boundaries.
3. Engage Your Microsoft Account Team: If your organization requires a binding, written business agreement or needs visibility into the compliance roadmap for these models, please contact your Microsoft Account Executive or Customer Success Manager. They can initiate the process to provide NDA-governed roadmap timelines.

How to Open a Support Ticket for Roadmap or Quota Inquiries

Please note that I do not have direct access to your Azure subscription, nor do I have authorization to open technical, compliance, or quota tickets on your behalf. If you need to request formal roadmaps, raise a quota increase, or obtain subscription-specific compliance guidance, please raise a ticket directly through the Azure Portal:

1. Sign in to the Azure Portal.
2. In the search bar at the top, search for and select Help + support.
3. Under the Support section, click on Create a support request.
4. Fill in the following fields:
   • Issue type: Select Technical (or Billing / Service and subscription limits (quotas) depending on your request).
   • Subscription: Select the target subscription.
   • Service: Select Cognitive Services (or search for Azure AI Speech / Azure AI Foundry).
5. Provide your target Azure Region, and reference the specific models (MAI-Transcribe-2 or Microsoft-Decision-1) in your description.

Thanks,
Suhail