Author: Mr Adrian Ramdat (Director of Training & Consultancy)
September 2026
What Is a CHIS? A Plain-English Starting Point
A Covert Human Intelligence Source, commonly referred to as a CHIS, is a person who establishes or maintains a personal or other relationship for a covert purpose, and then covertly uses that relationship to obtain information, provide access to information, or disclose information obtained through that relationship.
The key words are covert and relationship. The other party to the relationship is unaware that the relationship is being used for a covert purpose, such as obtaining information, providing access to information or facilitating the disclosure of information.
Understanding when someone crosses the line into CHIS territory is one of the most practically important, and most frequently misunderstood, areas of UK regulatory and enforcement law. Getting it wrong has real consequences: for investigations, for individuals, and for organisations.
What the Law Actually Says
The legal definition of a CHIS applies across England, Wales, and Northern Ireland under RIPA (the Regulation of Investigatory Powers Act 2000). Scotland operates under its own equivalent legislation, RIPSA, and the Channel Islands under RIPL, but the definition is consistent across all of them.
Under the legislation, a person is a CHIS if:
"(a) he establishes or maintains a personal or other relationship with a person for the covert purpose of facilitating the doing of anything falling within paragraph (b) or (c);
(b) he covertly uses such a relationship to obtain information or to provide access to any information to another person; or
(c) he covertly discloses information obtained by the use of such a relationship or as a consequence of the existence of such a relationship."
This is a three-part test. In practice, the first limb, establishing or maintaining a relationship for a covert purpose, is where most misunderstandings arise.
The Relationship Test: What Trips People Up
The CHIS Code of Practice (December 2022) is direct about this. In its discussion of Article 8, it explains that covert manipulation of a relationship by a public authority, where one party has a covert purpose and is acting on behalf of a public authority, may engage Article 8, regardless of whether private information is obtained.
That framing matters. It isn't simply about who gathers the intelligence, it's about how the intelligence is obtained. The relationship could be long-standing or newly formed. It could be personal, professional, or even entirely casual. What triggers the CHIS threshold is whether that relationship is being used, without the other party's knowledge, to access or disclose information.
A common misconception is that someone must be acting secretly in an obvious sense, like an informant in a TV crime drama. In reality, it's far more routine than that, for example, a colleague who continues a normal-looking working relationship while privately reporting to a regulator about suspected wrongdoing can easily meet the statutory definition and if they're not recognised and authorised, the consequences can be serious.
Situations that commonly arise in practice
A housing officer asks a client to stay in contact with a tenant and feedback information about suspected criminal behaviour. The relationship is being maintained and the purpose is covert. The important question is what is being done through that relationship and whether information is being obtained as a result. It is closer to the line than most people assume.
A friend of a suspect agrees to remain in contact and report on their movements or conversations to an investigator. On the face of it this looks straightforward, but the detail matters, the nature of the relationship and how it's being used affect the legal position.
A regulator asks a member of staff to continue normal social interactions with a colleague and report on suspected illegal practices. This scenario catches people out consistently. Many assume that because the person is a visible employee, nothing covert is happening, but visibility alone doesn't determine CHIS status. The analysis goes deeper than job title or uniform, and it's worth understanding exactly where the threshold sits before making that call.
There is another situation that can easily be missed. A person may independently maintain a relationship in order to obtain information about suspected criminal activity and then provide that information to an organisation. They may never have been formally tasked to do it. If the organisation becomes aware of what is happening and intends to make use of the information, the CHIS position needs to be considered. The absence of formal tasking does not make the issue disappear.
Situations that are generally outside the framework
A member of the public submits a one-off tip about suspicious activity. Typically, this won't engage the CHIS framework but even here, context can shift the picture if ongoing activity follows.
A business owner provides CCTV footage from their premises. Passive data provision of this kind generally sits outside the framework, though again the surrounding circumstances may matter.
Online Activity: Don't Assume Distance Means Exemption
One of the faster-growing areas of confusion involves online interactions. The CHIS Code of Practice is explicit: the CHIS framework applies equally in digital environments. A relationship formed or maintained through social media, messaging platforms, gaming networks, or closed online forums can meet the CHIS threshold if it's being used covertly.
Consider two examples. A police employee poses as a teenager inside a private online group to build trust and gather intelligence about knife crime. That's CHIS activity, a relationship is being established and maintained covertly.
Separately, if an individual is asked by police to participate in a closed chat group and report on discussions about illegal activity, the digital nature of that relationship doesn't change its legal character.
The use of avatars or pseudonyms doesn't alter the analysis either. If someone is directed to engage in ongoing covert online interactions for intelligence purposes, CHIS authorisation is very likely required.
Why Getting This Wrong Is So Costly
Failing to correctly identify CHIS activity isn't a paperwork issue, it carries genuine operational and legal risk.
Investigations can be compromised, and the way information or evidence has been obtained may come under serious scrutiny. Individuals operating without authorisation face real personal risk, with no formal safeguards or risk assessment in place.
Organisations can face adverse inspection findings from the Investigatory Powers Commissioner's Office (IPCO), which monitors and scrutinises CHIS use and complaints to the Investigatory Powers Tribunal (IPT) can result in investigations, findings of breach, and orders for redress.
IPCO has made it clear that unauthorised or misidentified CHIS use is a governance failure and that failure almost always traces back to a gap in understanding the relationship test.
Building Confidence Through Training
Once professionals genuinely understand the relationship element, decision-making becomes significantly more consistent and more defensible. The threshold isn't ambiguous once you know what to look for, the challenge is recognising it in the messy reality of day-to-day investigative activity.
At The Signature Brand Training & Consultancy, our sessions are built around exactly that, practical, case-based learning that's grounded in the legislation and the Code of Practice. We work with professionals across law enforcement, trading standards, housing enforcement, social care, regulatory bodies at all levels and organisations seeking to be RIPA compliant, from CHIS Awareness through to Handler, Controller, and Authorising Officer training.
If your team interacts with individuals who provide information, regularly or occasionally, ask yourself two questions:
Could you confidently identify the exact point at which a person becomes a CHIS?
Could you justify that assessment at court, to IPCO, or before the Investigatory Powers Tribunal?
If the answer isn't a solid yes, then it's time to make contact and see how we can help.
To find out more about CHIS Awareness training, RIPA/RIPSA Bitesize events, or our specialist CHIS Handler, Controller and Authorising Officer programmes, visit www.thesignaturebrand.co.uk or get in touch at info@thesignaturebrand.co.uk.