Guide · October 23, 2026 · 5 min read

What is CUI, and can it go in ChatGPT?

Service & VeteransLeaders

Want one workflow like this by email each Tuesday? It's free. Get it below ↓

Short answer: no. Controlled Unclassified Information does not go into ChatGPT, Gemini, Claude, Copilot, or any other personal AI account. An approved government tool can handle some of it. Your phone's chatbot cannot.

If you already know the paste rules, use AI and OPSEC: what never goes into a chatbot. This page owns the CUI piece: what it is, which categories show up in daily work, and the can/can't line for consumer tools versus authorized ones.

What CUI actually means

CUI is information the government creates or holds (or that someone creates for it) that a law, regulation, or government-wide policy says must be safeguarded or limited in who gets it. It is not classified. It still isn't public.

That's the definition in 32 CFR Part 2002, which implements Executive Order 13556. DoD's rule is DoDI 5200.48. The National Archives runs the CUI Registry, the official list of categories.

Older labels like FOUO (For Official Use Only) still show up. They aren't a free pass to paste. Treat legacy FOUO the same way you treat CUI until your security manager says otherwise.

Categories that show up at work

You don't need the whole Registry. These are the ones junior personnel, supervisors, and defense-industry folks hit most often, from the National Archives list:

If the banner or footer says CUI, or the cover block lists a CUI category, stop guessing. It is CUI. If you're unsure and the document came from a government system, ask your security manager before any AI tool sees it.

One concrete trap: personnel evaluations and award packages often sit in CUI categories. Don't paste a draft or finished report into a personal account. Work from scrubbed notes instead, as in using AI for EPB, NCOER, and FITREP bullets.

Can it go in ChatGPT?

No. DoDI 5200.48 is blunt: DoD personnel will not use unofficial or personal email accounts, messaging systems, or other non-DoD information systems for official business involving CUI, except approved or authorized government contractor systems.

A personal ChatGPT, Gemini, Claude, or Copilot account is a non-DoD information system. So is the free app on your phone. Pasting CUI there is an unauthorized disclosure problem, not a "I'll turn training off" problem. Training settings change who can use your chats for model improvement. They do not turn a consumer product into an approved CUI system.

As of Oct 2026, that line has not moved. Command policy can only get stricter.

What about GenAI.mil and other approved tools?

Authorized platforms are different. A January 28, 2026 Department of the Navy memo designates GenAI.mil as the Navy's CUI and Impact Level 5 generative-AI platform. The DON CIO summary says it is "fully authorized to handle CUI." It also says Protected Health Information and Personally Identifiable Information "are not permitted for use on this platform."

GenAI.mil runs on NIPR, so classified work stays elsewhere. And "authorized for CUI" is not "paste anything." Names tied to SSNs, DoD ID numbers, and medical details still come out first. For the broader allow/deny picture, see Can I use ChatGPT in the military?

Defense contractors follow the CUI rules in their contracts (often DFARS 252.204-7012 and NIST SP 800-171 on nonfederal systems). A personal chatbot is not that system. If your company gave you an approved AI workspace, use that. If it didn't, don't invent one.

Prompt: a second check after you scrub

This is a backup only. It does not decide whether something is CUI. You do that from markings and your security manager.

I'm checking scrubbed text before it goes into an AI tool.
The real document is marked [CUI / FOUO / unmarked / not sure].
Rules:
- List anything that still looks like a name, personal ID,
  medical detail, unit, location, schedule, capability,
  vulnerability, contract-sensitive figure, or technical
  detail that shouldn't be public.
- Suggest a placeholder for each item ([NAME], [UNIT],
  [DATE], [NUMBER], [SYSTEM]).
- Do not rewrite the text.
- Do not guess what any placeholder stands for.
- Do not tell me the text is "safe" or "cleared."

TEXT:
[paste only text you already scrubbed]

If the document is marked CUI and your only option is a personal account, the answer is still no. Scrubbing is for approved tools and for public, non-CUI tasks. It is not a workaround for DoDI 5200.48.

If you already pasted CUI

Don't just delete the chat. Deleting on your side does not pull the data back from the vendor. Tell your security manager or OPSEC coordinator what went in, which tool you used, and roughly when. DoDI 5200.48 expects unauthorized disclosures of CUI to be reported and corrected. Hearing it from you first is the better version of that day.

Then use the OPSEC scrub routine before the next paste. For your next marked document, check the banner first. If it says CUI, the tool question is already answered.

Sources

All checked October 23, 2026.

• DoDI 5200.48, Controlled Unclassified Information (CUI) (Mar. 6, 2020), especially Paragraph 3.10.b on personal and non-DoD systems
• 32 CFR Part 2002, Controlled Unclassified Information, including the definition in § 2002.4
• National Archives, CUI Registry category list
• National Archives, About CUI
• ASN(RD&A) and DON CIO joint memo designating GenAI.mil, Jan. 28, 2026, and the DON CIO summary, Feb. 24, 2026
• DFARS 252.204-7012 (contractor CUI safeguarding on covered systems), when applied by contract

Policies change, so confirm with your security manager and your command. How this is made: an AI editor drafts and fact-checks each article. If we get something wrong, we fix it and note the change.