From the Public Safety edition of October 28, 2026
Records show Portland police and city tech staff held at least eight meetings planning Microsoft Copilot use despite the city rule that excludes the Police Bureau, while flagging CJIS audit risk
Portland Police Bureau / Portland Bureau of Technology Services · Policing / generative AI for administrative and analytical work · Portland, Oregon, United States
- Publisher
- Street Roots
- Original publication
- Street Roots, Oct. 28, 2026
- Source retrieved
- 2026-10-29
- Event date
- 2026-10-28
What happened
Street Roots reports, from unredacted meeting records obtained through a public records request, that Portland Police Bureau (PPB), Bureau of Technology Services (BTS) and other city tech staff held at least eight meetings between May and September 2026 about using Microsoft Copilot Chat, although the city’s April 2026 approval of Copilot covered only employees outside the Police Bureau. An August record says “Copilot at Police is feasible” and plans to “pilot, test and validate” it, with more than 1,000 PPB users possible and BTS planning to fund the first full year. Participants flagged risks of “Failing a CJIS Audit” and “Exposing CJIS to AI”, noted “all users at Police have access to CJI”, and wrote that Microsoft documentation was vague about what is sent to Bing. Oregon State Police told the paper that AI systems must not interface with CJIS environments and no criminal justice information may be included in prompts, outputs or training data. PPB says the work is a discovery phase and deployment remains contingent on city and CJIS requirements; there is no PPB-specific Copilot policy. Because the work was not called an official pilot, PPB’s tech-trial directive, open for public comment through Oct. 31, never applied.
Why it matters
Shows how general-purpose office AI reaches police through enterprise licensing, and why criminal justice information rules, not the city AI policy alone, decide whether it can be used.
Evidence and measured results
Opened the Street Roots article and read it in full; quoted meeting-record phrases and agency statements are as reported; the underlying records and Portland’s Copilot privacy impact assessment were not separately opened.
Limitations and uncertainty
Single investigative news report; meeting-record quotes are as reported; no deployment has occurred; PPB and BTS say they will follow state and federal CJIS policy and that some uses would not involve CJI. The article does not show any CJI was exposed.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-29; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- A police bureau wants office AI efficiencies but cannot show that criminal justice information stays out of an enterprise assistant every user can reach.
- Stakeholders
- Police bureau leadership
- City Bureau of Technology Services
- City Data and Privacy Office
- State CJIS Systems Officer
- City administrator and council
- Discovery questions
- Which users and repositories hold CJI, and can they be technically excluded from the assistant?
- What data leaves the tenant for web grounding?
- Which approval process applies to discovery work before a formal pilot?
- What does the state CJIS officer require in writing?
- Value hypothesis
- Interpretation: a documented data-boundary assessment could let an agency decide on bounded non-CJI uses without risking a CJIS audit finding.
- Potential engagement
- A CJIS data-flow and governance assessment for one agency’s enterprise AI assistant.
- Unsupported claims
- That Copilot saves police time
- That any configuration is CJIS-compliant
- That PPB has exposed CJI
Pre-sales engineering
Role takeaway
- Fit
- Relevant to any agency whose city already licenses Microsoft 365 with Copilot.
- Architecture and integration
- Assistant inside the city Microsoft 365 tenant; web grounding via Bing; CJI repositories must be excluded by labels, permissions or separate environments.
- Prerequisites
- Inventory of CJI locations
- Sensitivity labelling
- Written CJIS officer position
- Police-specific use policy
- Constraints
- Oregon bars CJI in any AI workflow
- City approval excludes the Police Bureau
- Annual triennial state CJIS audits
- Security
- Block CJI from prompts and retrieval, log all assistant use, and document what leaves the tenant.
- Proof of value
- Test whether labelled CJI can be retrieved by the assistant
- Capture and review outbound web-grounding queries
- Audit-log sample review against policy
Delivery
Role takeaway
- Work
- Establish the approval path, data boundary and audit evidence before any trial.
- Dependencies
- City Data and Privacy Office
- State CJIS officer
- Microsoft documentation on data handling
- Ownership
- Police bureau technology lead with the City Data and Privacy Office
- Skills and adoption
- Training on permitted non-CJI uses and on spotting outdated or inaccurate outputs.
- Governance checkpoints
- Administrator or council decision on lifting the exclusion
- Privacy impact assessment for police use
- Pre-pilot CJIS review
- Acceptance criteria
- Zero CJI found in sampled prompts and outputs (proposed)
- Written police-specific policy before pilot (proposed)
- Formal sign-off recorded before any user access (proposed)
- Risks
- Discovery drifting into use outside the pilot process
- Shadow AI use continuing meanwhile
- CJIS audit finding
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Copilot sits inside the city’s Microsoft 365 tenant ($4 million a year, authorized through 2027); staff were assessing which Microsoft security tier and data flows (including Bing web queries) would be needed to meet CJIS requirements.
Governance
Who approves, reviews and stays accountable for outcomes?
The city AI rule lets the city administrator inspect and stop AI use; no council agenda item has addressed lifting the police exclusion; PPB’s own Equipment Authorization Directive lets PPB approve its own tech pilots and does not reference the City Data and Privacy Office.
Security and privacy
What data, permissions and controls need testing?
Oregon guidance bars any CJI in AI prompts, outputs, training or workflows; every PPB user has CJI access, so separation would have to be technical, not role-based. The 2025 city privacy assessment found 48 risks for non-police use alone.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
PPB cites staffing shortages and steady or rising workloads as the reason to explore efficiencies; records note users “will likely use it however they can”, a shadow-AI risk.
Procurement
What should contracts, pricing and exit terms secure?
Bundled AI in an existing enterprise license can bypass the usual surveillance-technology or pilot approval path; BTS planned to fund year one.
Operating model
Which teams own the service once it runs?
Discovery work happened outside both the formal pilot process and council review, so the governance trigger depends on what the work is labelled.
Publication history
- 2026-10-28Public Safety · Issue 527 resources
Stable resource ID: portland-police-copilot-planning-despite-city-ban-cjis-risk-20261028