What a Verillian record shows, framework by framework.
Your assessor decides what satisfies your controls.
Rulebooks
| Rulebook | Covers | What a Verillian record shows |
|---|---|---|
| CJIS | Criminal justice information | CJIS Security Policy v6.1 asks for audit records that establish the type of event, when and where it occurred, its source and outcome, and who or what was involved (AU-3), protection of audit information from unauthorized access, modification and deletion (AU-9), and retention for a minimum of one year (AU-11). A Verillian record carries each captured request with its time, the AI service, the ruling, and the user and device the checkpoint reports, signed on the device and held on infrastructure your agency runs. |
| HIPAA | Protected health information | The patient identifiers your policy flags are screened on the device before a prompt goes anywhere. Content is encrypted to your organization's key, created in your administrator's browser. Verillian never receives that key. Whether HIPAA makes an entry required documentation is for your counsel. |
| NIST 800-53 (federal) | Federal information systems | NIST SP 800-53 control AU-3 lists what an audit record should establish, AU-9 covers protection of audit information and AU-11 covers retention. A Verillian record carries each captured request with its ruling, the time, the AI service, and the user and device the checkpoint reports, signed on the device and kept on infrastructure you run. |
| CMMC 2.0 / 800-171 | Controlled unclassified information | It runs on your own hardware, and CMMC 2.0 assessments build on NIST SP 800-171 practices. Your assessor decides how they map to your scope. |
| FERPA / COPPA | Student records | The names, dates and other values your policy flags are screened on the device before a prompt reaches a provider. Each captured request lands in a signed record your district or institution holds, not a vendor. Whether COPPA applies to a tool is for your counsel. |
| Colorado SB 26-189 | Automated decision-making in consequential decisions | What the Colorado act asks a deployer to keep, and what a Verillian record of AI use on enrolled devices shows, clause by clause. Not legal advice. |
Want to see the record itself? Book a demo and we open a signed record together.
The rules you answer to already ask for a record.
| Rule | What it asks and what the record gives |
|---|---|
| CJIS audit controls | CJIS Security Policy v6.1 expects access to criminal justice information to be auditable. |
| HIPAA audit controls | 45 CFR 164.312(b) asks for mechanisms that record and examine activity in systems handling patient data. When AI becomes one of those systems, the sealed record gives your compliance team something to examine rather than something to assert. |
| Records that already apply | Retention schedules and public-records obligations don't pause because a draft came from AI. |
| The one law on point | California SB 524 already requires a law-enforcement report drafted with AI to say so, and the agency to keep a record of it. It's narrow and specific, and it points the same way the older rulebooks do: keep the record. |
See Verillian on a real device.
