The three publicly posted police AI use policies reviewed for this page do two things well: they require human review of AI output before anyone relies on it, and they ask for a note that AI was used on at least some work products. None of them keeps the AI’s first draft or logs who used AI on which report. Retention of the draft and an audit trail of who used AI come from statute instead, and as far as we can tell California’s is the only one that requires them. A complete policy needs to add a named owner, retention tied to the report’s own schedule, and coordination with discovery, on top of what those policies have in place.
What do the state statutes require the policy itself to say?
As far as we can tell, as of this writing California and Utah are the only two states with a statute written for AI-drafted police reports. Utah Code section 53-25-902 is the more specific of the two about the policy: it requires an agency’s own policy to tell employees which generative AI technologies they may use and for which uses and tasks, the importance of reviewing AI-generated content, and that violating the policy may bring administrative discipline, and to include the statute’s disclaimer and certification requirements. California’s Penal Code section 13663 requires a policy too, but a narrower one: a policy requiring an AI-generated official report to identify every AI program used, carry the statute’s disclosure sentence, and bear the officer’s signature. California’s retention and audit-trail duties, in subdivisions (b) and (c), sit on the agency directly rather than in the policy it must maintain, and Utah’s statute has no retention or audit-trail duty at all. The fuller comparison, including what each statute does and does not require, is worked through in what has to be preserved when an officer uses AI to draft a report, and this page will not repeat that table.
What does IACP actually publish on this?
Less than the question implies. The International Association of Chiefs of Police runs an Artificial Intelligence Resource Hub that, as posted, offers no freely readable model policy on record keeping. What it does offer freely is a Generative AI Primer and a Predictive AI Primer, and a link to the IACP Law Enforcement Cyber Center’s AI resources. The Generative AI Primer advises that an agency’s use of generative AI “should be governed by written policies” and points to outside frameworks: the generative AI profile of NIST’s AI Risk Management Framework, and DHS’s Generative AI Public Sector Playbook. The two IACP Policy Center resources the hub lists, “Implications Associated with Police Use of Artificial Intelligence” and “Implementing Technology,” can be downloaded only by members, and the second is described on its own page as under review, so neither could be read for this page. As far as we can tell, IACP’s freely available material today works as a primer and a pointer to other frameworks, not as a record-keeping standard a department could adopt directly.
What do real, currently adopted department policies require today?
Three publicly posted policies, from Fargo, North Dakota, Boulder, Colorado, and St. Paul, Minnesota, share a core, and St. Paul’s repeats much of its wording from the other two. All three keep department data, including criminal justice information, out of public AI tools unless a tool is approved or the data is safe to share; all three require thorough human review of AI output, including AI-drafted report narratives, before it is used; and all three ask for a note that AI was used on at least some work products. Fargo’s and St. Paul’s also require the Chief of Police or a designee to approve a GenAI system, Fargo’s before any deployment and St. Paul’s before work data goes into a publicly available one. Fargo’s policy goes further than the other two: it names a specific AI coordinator role, assigned in that department to the Professional Standards Division commander, whose written duties include maintaining an inventory of approved GenAI systems, conducting periodic audits of each approved system’s performance, developing training for authorized users, and developing procedures with the Brady information coordinator and the Records Manager for compiling and potentially releasing GenAI-related discovery or records.
Where do those real policies fall short of what the record eventually has to show?
None of the three reviewed here states a retention period for the AI’s first draft, and none requires a per-use audit trail naming who used the tool on which report, the way California’s statute does. Fargo’s policy comes closest, with its discovery and Brady coordination duty and its vetting criterion on “histories, audit logs, and other processes,” and even there it has the AI coordinator develop procedures and weigh a system’s audit logs when vetting it, rather than stating a retention period or a logging requirement outright. A department in California or Utah has to add what its own state statute requires on top of a template like this. A department outside both states has, as far as we can tell, no statute written for AI-drafted reports requiring it to, and the gap is exactly where a template stops and a department’s own judgment has to start.
A disclosure statement and a human-review requirement are necessary, and some form of both appears in all three policies reviewed here. Neither one, by itself, produces a record of who used AI on which report, or preserves the draft the report changed from. That has to be added deliberately; none of the three policies adds it.
What should a complete record-keeping policy require?
- Name the tool and the task, the way Utah’s statute requires: which generative AI systems staff may use, and for which work, rather than a blanket authorization.
- Name an owner for AI governance inside the department, the role Fargo’s policy calls an AI coordinator, responsible for the approved-system inventory, training, and periodic review, rather than leaving it to whoever happens to be asked.
- Require disclosure and human review, found in some form in all three policies reviewed here: a statement that AI assisted, and a person’s review before the work is used or the report is filed.
- Set retention by the report’s own schedule, not a shorter default. The audit trail and the underlying fields it needs to carry are covered in audit trail requirements for AI use in a police department; this page will not repeat that list.
- Assign discovery and Brady coordination explicitly, the way Fargo’s policy directs its AI coordinator to work with a Brady information coordinator and the Records Manager, rather than discovering the gap when a request arrives. See is an AI-generated police report discoverable for what that coordination is actually answering.
- Review the policy against your own state’s statute, not only against a shared template. California and Utah both require more than the policies reviewed here provide on their own, and a department in neither state can still use their statutes as a reference point.
Sources
- California Penal Code section 13663, added by SB 524 (2025 to 2026 Regular Session). Chaptered bill text, read September 26, 2026.
- Utah Code sections 53-25-901 and 53-25-902, enacted by SB 180 (2025 General Session). Current code section, read September 26, 2026.
- International Association of Chiefs of Police, Artificial Intelligence Resource Hub, read September 26, 2026.
- International Association of Chiefs of Police, Generative AI Primer. Full primer, read September 26, 2026.
- Fargo Police Department, Policy 345, Generative Artificial Intelligence Use, original issue August 12, 2025. Full policy text, read September 26, 2026.
- Boulder Police Department, General Order 131, Artificial Intelligence, effective September 19, 2024. Full policy text, read September 26, 2026.
- St. Paul Police Department, Policy 236.06, Generative Artificial Intelligence (GenAI), effective October 17, 2025. Full policy text, read September 26, 2026.
Where Verillian fits
Verillian governs AI use on the devices you enroll. A checkpoint on each device sits between your people’s AI tools and agents and the AI providers. A tool call your policy bans is removed before your machine can run it. Each record is signed on the device it came from and hash-chained to the one before it, so a change to its signed fields is detectable, and it stays on your own infrastructure. The admin server runs where you choose: on premises or in a private cloud you run. macOS, Windows and Linux are supported. For a department, that record gives the AI coordinator something concrete to review, the user and device the checkpoint reports and when, for use that starts on an enrolled device.
When a vendor’s service calls a model on the vendor’s servers, as an ambient scribe or a hosted report-writing tool does, the record of what that model received is created on the vendor’s side, and the contract is your lever for it. What Verillian gives you is the record of AI use that starts on your own devices.
Our compliance mappings show the controls the platform supports, the audit trail page shows what a device-side record contains, and the public safety section of the site covers what this looks like for an agency already running AI tools day to day.
