CJIS Compliant AI: What the CJIS Security Policy Means for AI Tools in Law Enforcement

There is no CJIS certified AI product

The FBI does not run a certification program for products. Microsoft’s CJIS compliance page states that the FBI does not certify Microsoft’s compliance, and that a Microsoft attestation is instead built into agreements with each state’s CJIS authority and with customers. As of 24 August 2026 Microsoft listed such agreements covering criminal justice agencies in 47 states and the District of Columbia.

Responsibility runs through a chain. The FBI CJIS Division sets the policy. Each state’s CJIS Systems Agency (CSA) and its CJIS Systems Officer (CSO) approve access, may add stricter rules, and audit every agency that connects through them at least once every three years. The FBI audits the CSAs on the same cycle. A local police department or sheriff’s office is the agency of record and carries the outcome.

For AI that means two practical things. Ask a vendor which states’ CSAs have signed its agreements, not whether it holds a certificate. And bring your CSA in before procurement, because the CSA can refuse a design that another state accepts.

CJIS Security Policy v6.1 in brief

The current policy is version 6.1, dated 25 June 2026. Version 6.0, published on 27 December 2024, completed the modernization that reorganized the policy around NIST SP 800-53 Revision 5 control families. Version 6.1 adds the Advisory Policy Board changes approved during 2025.

Not every control is enforced yet. Requirements carried over from version 5.9 and those marked Priority 1 have been auditable and sanctionable since 1 October 2024. Priority 2, 3 and 4 requirements are in a zero-cycle that ends on 30 September 2027, so auditors look at them without sanctions until then. Some states still audit against older versions for a period, so confirm with your CSA which version applies to your next audit.

The policy says nothing specific about artificial intelligence. Its one mention is AI as a malware detection technique. An AI system that touches CJI simply inherits the controls below.

Where criminal justice information shows up inside an AI tool

The policy defines CJI as FBI CJIS provided data needed by law enforcement and civil agencies, including biometric, identity history, biographic, property and case or incident history data. Many CSAs treat records management system data and incident reports that contain those elements as CJI, so assume a report-writing or case-summary tool will touch it.

Once an officer or analyst uses AI on that material, copies appear in places a records manager may not expect:

• the prompt and the model’s working context;
• transcripts produced from body-worn camera or interview audio;
• the retrieval index and its embeddings;
• conversation history, drafts and generated summaries;
• application logs, debug traces and vendor telemetry.

Each copy needs the encryption, location and access controls in the table. The metadata rule matters most here, because an embedding or a usage log looks harmless but is derived from CJI.

Personnel screening and the Security Addendum decide most vendor questions

The personnel controls apply to anyone with unescorted logical or physical access to unencrypted CJI, whether the system runs in a physical data center, a cloud or both. The agency decides who falls in that group.

The policy’s own examples show how the answer changes with the design:

• Agency-run infrastructure. A local police department vets the contractor IT administrators and the janitorial staff who can reach the rooms where CJI is processed, and re-checks suitability every five years.
• IaaS with agency-held keys. An agency runs its own encrypted virtual private cloud and holds the only keys. The cloud provider’s staff cannot see unencrypted CJI, so no fingerprint checks are needed for them.
• SaaS where the vendor manages the application. A records system vendor supports the application and can see unencrypted CJI, so its employees must meet the personnel controls. The underlying cloud provider does not, because the SaaS vendor holds the keys.

Hosted AI services usually look like the third case. The model has to read plaintext to answer, and the vendor’s engineers operate the service. That puts their support staff in scope for fingerprint checks, and puts the vendor under the CJIS Security Addendum, a uniform agreement approved by the FBI Director for the Attorney General under 28 CFR 20.33(a)(7). The Addendum limits use of the data to the purposes the agency provided it for, requires security consistent with the policy, and provides for sanctions. Only the FBI can modify it.

The policy also warns that FedRAMP, StateRAMP or SOC 2 reports can add assurance but do not guarantee CJIS compliance. A FedRAMP High AI service is a better starting point than a consumer one, not a finished answer.

Is ChatGPT CJIS compliant? Cloud AI options compared

The table summarizes what vendors publish, checked on 22 October 2026. Your CSA has the final word on each.

AI for law enforcement report writing

Report drafting is the use case that put AI on most chiefs’ desks. Axon’s Draft One is the best known product. Axon says body-worn camera audio is uploaded and transcribed automatically, a draft narrative is produced from the transcript, and the officer must fill in missing details, review and sign off before submission. Its FAQ names OpenAI’s GPT-4 Turbo as the underlying model, says creativity is turned down to limit speculation, and says the draft itself is not stored, though each use is logged.

Two states now regulate the practice directly.

Utah SB 180, effective 7 May 2025, requires every law enforcement agency to have a generative AI policy listing permitted tools and uses. Any police report or record created wholly or partly with generative AI must carry a disclaimer and a certification by the author that they read and reviewed it for accuracy.

California SB 524, approved on 10 October 2025 and added as Penal Code 13663 from 1 January 2026, goes further. An AI-assisted official report must name every AI program used and state, on each page or in the text, that it was written fully or in part using artificial intelligence. The officer signs to verify the facts are true. The agency keeps the first AI draft for as long as the report, and keeps an audit trail of who used the AI and which video and audio footage it drew on. A draft other than the signed report is not the officer’s statement. Vendors may not share, sell or use the agency’s data except for the agency’s purposes or a court order, though they may access it for troubleshooting, bias mitigation and accuracy work.

The California rules collide with any product that discards its first draft. Agencies there need a tool that keeps the draft and the source footage reference, or a process that saves them outside the tool.

Evidence, disclosure and Brady exposure

Report drafting raises courtroom questions that the CJIS policy never addresses. The King County Prosecuting Attorney’s Office in Washington told local agencies in a September 2024 memo that it would not accept AI-assisted reports for now. It cited a draft that placed an officer at a scene he never attended, and the problem that an officer blaming the AI for an error would have no draft to prove it.

Three exposures follow:

• Discovery. The first draft, the transcript and the prompt history may be discoverable. Treat them as records from the moment they exist.
• Impeachment. If the signed report differs from the AI draft or the footage, defense counsel will ask why. Keep the edit history so the officer can explain each change.
• Brady and Giglio. Material inconsistencies an agency discovers between AI drafts and evidence may need to be disclosed to prosecutors.

Agree a written approach with your prosecutors before rollout. It is easier than defending a report in court without the draft.

Other law enforcement AI uses that fit CJIS controls

Report drafting gets the attention, but several other tasks are lower risk and easier to supervise:

• Records requests and redaction. A model proposes redactions of names, dates of birth, addresses and juvenile details in reports or transcripts, and a records clerk accepts or rejects each one before release.
• Case file summaries. Detectives get a chronology and a list of open questions across a long case file, with every statement linked back to its page.
• Policy and procedure questions. Officers ask the general orders manual, with answers cited to the section. This often needs no CJI at all.
• Transcription. Interviews and radio traffic are transcribed by a speech-to-text model on agency hardware, as described in our guide to running Whisper on premises, and the transcript stays inside the CJIS boundary.
• Document intake. Warrants, court orders and records from other agencies are classified and routed, an approach covered in our article on agents for government document intake.

Uses such as facial recognition, predictive policing or risk scoring raise far heavier civil rights questions and are outside this guide. Federal agencies treat many of them as high-impact AI under OMB M-25-21, and several states restrict them.

Why an agency data center simplifies CJIS for AI

Most agencies already run CJIS-compliant facilities for their records management system, CAD and mobile data terminals. The servers sit in a physically secure location, administrators are fingerprint-checked, MFA is in place and the CSA has audited the setup.

Putting the AI model and its data in that same environment removes the hardest vendor questions. There is no outside provider whose engineers can read plaintext prompts, so no new group of people to screen. CJI never leaves the facility, so the APB-member location rule is met by design. Encryption, logging and retention follow controls the agency already operates and already shows its auditors. The Security Addendum question narrows to whatever support access the software vendor has, which the agency can restrict to escorted sessions.

The cost is running the hardware and keeping models updated. Many agencies split the work: a government cloud tenant for office productivity, and a local model for reports, transcripts and anything containing CJI.

How VDF AI fits a CJIS-compliant agency network

VDF AI is software an agency installs on its own servers, including inside the facility that already hosts its CJIS systems, or on an air-gapped network. Models, retrieval indexes, conversation history and audit logs stay on that hardware, and the VDF AI Router’s air-gap mode keeps every request on local models. VDF AI holds no CJIS approval of its own; the deployment falls under the agency’s controls and its CSA’s audit like any other system there.

The platform maps to the controls above. Officers and staff sign in through Microsoft Entra ID single sign-on, where your MFA policy applies, and Entra security groups map to roles; other identity providers connect through an SSO-aware reverse proxy. Role-based access control limits which units see which assistants, agents and document collections, and retrieval only returns records a user is allowed to read. Governed agents can draft a report narrative, a redaction set or a case chronology and then stop at a human approval step. Each turn records the user, model, retrieved sources, tool calls and output, so the agency can keep a first draft and its audit trail for as long as its records schedule requires.

For more on public sector deployments, see the government and defense solution, the government use cases and the defense document classification playbook. This guide reflects the policy and laws as published on 22 October 2026 and is not legal advice.