--- title: "What is CUI, and can it go in ChatGPT?" description: "What Controlled Unclassified Information (CUI) is, which categories show up in daily work, and why it must not go in ChatGPT or any personal AI account." canonical: https://aiexplainedplainly.com/guides/can-i-put-cui-in-chatgpt/ date: "2026-10-23" source: "AI Explained Plainly" --- # What is CUI, and can it go in ChatGPT? *Guide, October 23, 2026* ## TL;DR - **What you get:** a plain-English CUI definition, the categories that show up at work, and a clear can/can't for ChatGPT vs GenAI.mil. - **Time:** about 12 minutes to read, plus a few minutes to check one marked document. That's an estimate. - **Do this:** if a document says CUI or FOUO, keep it out of every personal AI account and use only an approved tool. Short answer: no. Controlled Unclassified Information does not go into ChatGPT, Gemini, Claude, Copilot, or any other personal AI account. An approved government tool can handle some of it. Your phone's chatbot cannot. If you already know the paste rules, use [AI and OPSEC: what never goes into a chatbot](https://aiexplainedplainly.com/guides/ai-opsec-checklist/). This page owns the CUI piece: what it is, which categories show up in daily work, and the can/can't line for consumer tools versus authorized ones. ## What CUI actually means CUI is information the government creates or holds (or that someone creates for it) that a law, regulation, or government-wide policy says must be safeguarded or limited in who gets it. It is not classified. It still isn't public. That's the definition in 32 CFR Part 2002, which implements Executive Order 13556. DoD's rule is DoDI 5200.48. The National Archives runs the CUI Registry, the official list of categories. Older labels like FOUO (For Official Use Only) still show up. They aren't a free pass to paste. Treat legacy FOUO the same way you treat CUI until your security manager says otherwise. ## Categories that show up at work You don't need the whole Registry. These are the ones junior personnel, supervisors, and defense-industry folks hit most often, from the National Archives list: | Category (Registry name) | What it often looks like | |---|---| | Military Personnel Records | Evaluations, awards packages, personnel actions | | Personnel Records / Privacy | Rosters with personal data, badging files | | Health Information | Medical readiness, profiles, clinical notes | | Controlled Technical Information | Specs, drawings, tech manuals with military use | | Operations Security | Critical-information lists, vulnerability write-ups | | Procurement / Source Selection | Proposals, bid details, source-selection notes | | Information Systems Vulnerability Information | Patch status, scan results, network weaknesses | If the banner or footer says CUI, or the cover block lists a CUI category, stop guessing. It is CUI. If you're unsure and the document came from a government system, ask your security manager before any AI tool sees it. One concrete trap: personnel evaluations and award packages often sit in CUI categories. Don't paste a draft or finished report into a personal account. Work from scrubbed notes instead, as in [using AI for EPB, NCOER, and FITREP bullets](https://aiexplainedplainly.com/guides/ai-for-epb-ncoer-fitrep-bullets/). ## Can it go in ChatGPT? No. DoDI 5200.48 is blunt: DoD personnel will not use unofficial or personal email accounts, messaging systems, or other non-DoD information systems for official business involving CUI, except approved or authorized government contractor systems. A personal ChatGPT, Gemini, Claude, or Copilot account is a non-DoD information system. So is the free app on your phone. Pasting CUI there is an unauthorized disclosure problem, not a "I'll turn training off" problem. Training settings change who can use your chats for model improvement. They do not turn a consumer product into an approved CUI system. As of Oct 2026, that line has not moved. Command policy can only get stricter. ## What about GenAI.mil and other approved tools? Authorized platforms are different. A January 28, 2026 Department of the Navy memo designates GenAI.mil as the Navy's CUI and Impact Level 5 generative-AI platform. The DON CIO summary says it is "fully authorized to handle CUI." It also says Protected Health Information and Personally Identifiable Information "are not permitted for use on this platform." | Tool | CUI | PII / PHI | Classified | |---|---|---|---| | Personal ChatGPT, Gemini, Claude, Copilot | No | No | No | | GenAI.mil (when your command authorizes it) | Yes, within policy | No | No | | Other command-approved tools | Only if approval covers CUI | Follow that tool's rules | Only if accredited | GenAI.mil runs on NIPR, so classified work stays elsewhere. And "authorized for CUI" is not "paste anything." Names tied to SSNs, DoD ID numbers, and medical details still come out first. For the broader allow/deny picture, see [Can I use ChatGPT in the military?](https://aiexplainedplainly.com/guides/can-i-use-chatgpt-in-the-military/) Defense contractors follow the CUI rules in their contracts (often DFARS 252.204-7012 and NIST SP 800-171 on nonfederal systems). A personal chatbot is not that system. If your company gave you an approved AI workspace, use that. If it didn't, don't invent one. ## Prompt: a second check after you scrub This is a backup only. It does not decide whether something is CUI. You do that from markings and your security manager. ``` I'm checking scrubbed text before it goes into an AI tool. The real document is marked [CUI / FOUO / unmarked / not sure]. Rules: - List anything that still looks like a name, personal ID, medical detail, unit, location, schedule, capability, vulnerability, contract-sensitive figure, or technical detail that shouldn't be public. - Suggest a placeholder for each item ([NAME], [UNIT], [DATE], [NUMBER], [SYSTEM]). - Do not rewrite the text. - Do not guess what any placeholder stands for. - Do not tell me the text is "safe" or "cleared." TEXT: [paste only text you already scrubbed] ``` If the document is marked CUI and your only option is a personal account, the answer is still no. Scrubbing is for approved tools and for public, non-CUI tasks. It is not a workaround for DoDI 5200.48. ## If you already pasted CUI Don't just delete the chat. Deleting on your side does not pull the data back from the vendor. Tell your security manager or OPSEC coordinator what went in, which tool you used, and roughly when. DoDI 5200.48 expects unauthorized disclosures of CUI to be reported and corrected. Hearing it from you first is the better version of that day. Then use the [OPSEC scrub routine](https://aiexplainedplainly.com/guides/ai-opsec-checklist/) before the next paste. For your next marked document, check the banner first. If it says CUI, the tool question is already answered. ## Sources All checked October 23, 2026. - [DoDI 5200.48, Controlled Unclassified Information (CUI)](https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF) (Mar. 6, 2020), especially Paragraph 3.10.b on personal and non-DoD systems - [32 CFR Part 2002, Controlled Unclassified Information](https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002), including the definition in ยง 2002.4 - [National Archives, CUI Registry category list](https://www.archives.gov/cui/registry/category-list) - [National Archives, About CUI](https://www.archives.gov/cui/about) - [ASN(RD&A) and DON CIO joint memo designating GenAI.mil](https://www.doncio.navy.mil/FileHandler.ashx?id=24946), Jan. 28, 2026, and the [DON CIO summary](https://www.doncio.navy.mil/ContentView.aspx?id=20456), Feb. 24, 2026 - DFARS 252.204-7012 (contractor CUI safeguarding on covered systems), when applied by contract *Policies change, so confirm with your security manager and your command. How this is made: an AI editor drafts and fact-checks each article. If we get something wrong, we fix it and note the change.*