--- title: "Does CJIS allow ChatGPT? What v6.1 says | Verillian" description: "The CJIS Security Policy never names ChatGPT. It governs criminal justice information, so the answer turns on whether CJI goes in. Here is what v6.1 says about external systems, vendor agreements and county IT." url: "https://verillian.ai/blog/does-cjis-allow-staff-to-use-chatgpt/" --- # Does CJIS allow staff to use ChatGPT? October 28, 2026 / 4 min read The CJIS Security Policy never names ChatGPT. It governs criminal justice information, so the answer turns on whether CJI goes in. Here is what v6.1 says about external systems, vendor agreements and county IT. It depends on what goes in. The CJIS Security Policy never names ChatGPT or generative AI; it governs criminal justice information. A question with no CJI in it falls under your agency’s own AI policy. Once CJI goes in, the AI service is an external system, and the policy’s rules for external systems, contractors and personnel apply in full. ## Does the CJIS Security Policy mention ChatGPT? No. The current version, [CJIS Security Policy v6.1](https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf), dated June 25, 2026, does not mention ChatGPT, generative AI or large language models. Its one use of “artificial intelligence” is about malware detection. It is written around the data: criminal justice information (CJI) is “all of the FBI CJIS provided data necessary for law enforcement and civil agencies to perform their missions including, but not limited to biometric, identity history, biographic, property, and case/incident history data.” ## When can staff use it without CJIS applying? When no CJI goes in. Drafting a public notice, summarizing a published report or asking a general question touches no CJI, so the test is your agency’s own [AI use policy](https://verillian.ai/blog/what-should-a-county-ai-use-policy-include/). Staff decide what they paste, so that policy has to say plainly what may never go in. ## What happens when CJI goes in? The AI service becomes an external system, one “used by but not part of organizational systems.” Control AC-20 gives the agency two choices: “Establish agency-level policies governing the use of external systems,” or “Prohibit the use of personally-owned information systems including mobile devices (i.e., bring your own device \[BYOD\]) and publicly accessible systems for accessing, processing, storing, or transmitting CJI.” AC-20(1) then permits that use only after “Verification of the implementation of controls on the external system” or “Retention of approved system connection or processing agreements.” A staff member’s own ChatGPT account, opened with no agency agreement, has neither. ## What does the AI vendor have to sign? A private contractor with access to CJI works under the CJIS Security Addendum, “a uniform addendum to an agreement between the government agency and a private contractor, approved by the Director of the FBI.” The policy’s own cloud example also puts the agency on the hook for Personnel Security for a hosted provider’s staff who can reach unencrypted CJI. Who holds the encryption keys changes that answer, so ask it before the pilot, not after. ## Does this reach county and city IT? Yes: “An example of an NCJA (government) is a city information technology (IT) department.” The policy applies to an IT department that supports the sheriff or police under a management control agreement, and to any AI tool it rolls out on systems that hold CJI. ## What should a county do now? - **Write down whether CJI may ever go into an AI tool**, and if so, which tools. - **Put the agreement in place first** for any tool that may hold CJI, Security Addendum included, and know who holds the keys. - **Plan the audit record.** Our guide to [what CJIS requires before staff use AI](https://verillian.ai/blog/cjis-and-ai/) covers the logging rules and the October 1, 2027 date. ## Where Verillian fits Verillian keeps the record of every captured AI interaction on your agency’s own servers, under your own keys, on a CJIS-ready architecture aligned with CJIS Security Policy v6.1. Verillian never receives your prompts, responses or records. *Sources read on 28 October 2026.* [All writing](https://verillian.ai/blog/) ## New posts by email Email Subscribe Yes, Verillian can email me product updates and recommendations. I can unsubscribe at any time. We use your email to send what you asked for, as described in our [privacy policy](https://verillian.ai/legal/privacy/). ## See Verillian on a real device. [Request a demo](https://verillian.ai/demo/)