AI for Document Review in Government: Disclosure Decisions That Survive Review
This is about the information rights and disclosure desk inside a public body: the team that takes freedom of information requests, subject access requests, and the disclosure obligations attached to inquiries and litigation, and decides what is released. It is not about the casework systems that produced the documents, and it is not general records management.
The distinguishing feature of the work is that every withholding decision is a legally reasoned one. It has to survive an internal review, a regulator, and sometimes a tribunal. What defends it is the reasoning written at the time, not the better argument someone assembles two years later under pressure. Meanwhile the statutory deadline runs whether or not anyone has yet found the material. Exemptions, time limits and appeal routes differ by jurisdiction; what follows is the shape of the work, not the law.
Triage, clarification and the clock
Many requests arrive underspecified. Others are precise but are really twelve requests wearing one envelope, each landing on a different business area with a different exemption profile.
An agent is good at the decomposition. It splits the request into discrete asks, maps each to the teams likely to hold the material, flags what is already published, produces the first scope estimate that a cost limit decision rests on, and drafts the clarification letter for the officer to send.
One caution. Clarification stops the clock in many regimes, which makes it tempting as a delay tactic, and an agent that quietly narrows a request into something convenient has changed the question. The split must be visible to the requester in the words of the letter.
Locating the material across systems nobody migrated
The hard part is rarely the decision, it is establishing that you have found everything. Material sits in shared drives structured for a reorganisation three ago, in mailboxes, in case systems, in a records management system half the organisation never adopted, and in chat histories nobody has scoped.
An agent can propose the custodian list and search terms, run those searches across the repositories it is connected to, and report what it could not reach. The record of where you searched, with what terms, and what you knowingly excluded is the first thing a regulator asks for when a requester says you must hold more. Most desks reconstruct that from memory; an agent produces it as a by-product.
Duplicates, versions and the near identical draft
A search across four repositories returns the same document many times over, plus a run of near identical drafts. Exact duplicates collapse by hash. Versions cannot, because the paragraph carrying the sensitivity may exist in one draft and not the next, and each version in scope needs its own decision. Group the version family, show what differs between members, and carry a decision across only where the text is identical.
Exemptions are a reasoned test, not a keyword match
Applying an exemption means asking a structured question about specific words on a page: what harm would follow, to whom, how likely, and whether the information falls within the class described.
An agent can do that preparation honestly. For each candidate passage it proposes an exemption, quotes the text it relied on, and sets out the elements of the test with what it found for each, which gives the reviewer something to correct rather than something to compose. It also surfaces what nobody flagged: the commercial figure in an annex.
What it cannot do is the public interest balance. That turns on circumstances the documents do not contain: what is already public, what the organisation is currently being accused of, how much this disclosure adds to an argument already underway. The most an agent should do is assemble the arguments both ways and leave the weighing to the officer who will defend it.
Personal data, and the difference between a name and an identity
Third party personal data is the most common reason to withhold. Detecting names, addresses and identifiers is a solved problem, and an agent finds more of them than a tired human reading at speed.
Identity is different. A document stripped of every name can still identify someone completely: the only person who made that complaint, the officer described by their role in a team of two, the member of staff whose absence dates are legible from a meeting record. That reassembly happens from context, where the machine has to be ambitious rather than literal. A useful agent does not only tag entities, it tells the reviewer who a passage points at.
Subject access on overlapping material
Subject access requests run over much the same material with an entirely different test, and one property changes the job: the requester is in the documents, appearing in correspondence they never saw, described by colleagues, assessed, complained about.
An agent helps by separating the requester's personal data from documents that merely mention them, by finding every place they appear under variant spellings, former names, staff numbers and pronouns, and by flagging where releasing their data exposes a third party. What it should not do is decide which route a request travels under, which turns on the requester's intent.
Mosaic effects, the disclosure log and what you published last year
A disclosure is never assessed alone. A requester holds what you released last year, what a neighbouring body released, and what is on your publication scheme. Information harmless in isolation becomes identifying once joined to that.
An agent is well placed here: this is retrieval at a scale no person holds in their head. Before release it checks the proposed set against your disclosure log, your proactive publications and prior sets on the same subject matter, and reports what, joined together, identifies someone or reconstructs a withheld figure. It can also maintain the log and draft the publication entry.
Consistency with your own previous decisions
Public bodies are most often caught out not by a wrong decision but by two different decisions on the same subject matter, made by different officers who never spoke.
Retrieval across your own decision history fixes that. When a reviewer opens a passage, the agent shows the closest previous calls, what was released and withheld on what ground, and whether any went to appeal and how it ended. Departing from a previous decision is legitimate; doing it without noticing is not. The agent's contribution is that the officer knows they are departing and says why.
Redaction that removes the text rather than covering it
Redaction has to destroy the underlying content, not conceal it visually. Black rectangles over live text, hidden layers, tracked changes, comment threads, document properties, image metadata and cropped images that retain the crop have all produced incidents in organisations that believed they had redacted properly.
Treat this as an engineering control, not a review step. Flatten and rebuild the released file, run an independent extraction pass over the output to confirm no redacted string is recoverable, and refuse anything that fails. An agent can also check each redaction carries the exemption it was applied under.
Inquiry and litigation disclosure at a scale no team is staffed for
Statutory inquiries and major litigation impose volumes an information rights desk was never sized for, alongside an ordinary caseload that does not pause. Relevance is set by someone else's rubric, and the timetable is not yours.
The agent does the first pass at volume: relevance against the stated criteria, a confidence score, the passage it relied on, and routing of anything sensitive or ambiguous to a human queue. The value is concentrating senior attention on the documents where judgement changes the outcome rather than spreading it evenly.
Internal review, the regulator and the appeal
At internal review the whole case is the contemporaneous record. If the reason was never written down there is nothing to defend, and the officer reconstructing it is guessing.
So the reasoning captured at decision time is not documentation overhead. An agent can assemble the review bundle in full: the request, the search record, every decision with its ground and the officer who made it, the comparable cases. It should never invent a justification after the fact where the original reasoning is missing. That gap is a finding and should be reported as one.
Retention and sensitivity review at transfer
The same capability serves records approaching transfer to an archive or scheduled destruction. Sensitivity review at transfer is disclosure review with a longer horizon and a far larger corpus.
An agent can work a transfer batch, proposing which files are clear, which need a reviewer and which are candidates for closure. It also flags the awkward finding: material destroyed that should have been kept, or kept long past its schedule while requests for it arrived.
Where AI fails here
Public interest balancing is the clearest limit. It depends on current context the documents do not contain, and a model asked to weigh it produces fluent reasoning that reads defensibly and reflects nothing.
Second, these systems are inconsistent at the margin in ways that are hard to detect. The same borderline passage can attract different exemptions in two runs. On a desk whose worst failure mode is inconsistency, that has to be controlled by fixing decisions once and carrying them forward explicitly.
Third, they miss sensitivity obvious to anyone who knows the organisation: the project not yet announced, the individual whose situation is known internally, the phrasing that reads as an admission. A model has no institutional memory unless you give it one.
Fourth, redaction failure is silent: the model believes it removed something, and only an independent extraction check over the output proves otherwise.
Finally, overconfidence in the search is what produces regulator findings. An agent reporting a clean result across systems it never reached is worse than no agent, because it feels thorough.
What to put in front of a reviewer first
Start where the work is mechanical and the decision stays human. Search record and scope decomposition, then deduplication and version grouping, then candidate exemption flagging, a reviewer accepting or rejecting every call. The reviewer's judgement is the product. The machine's job is to have it ready to make.
Measure it against decisions your team already made: take a closed quarter, run the agent over the same material, compare. You are looking for what it missed entirely, the only error class a reviewer cannot catch. Then for how often it flagged material a person passed over, which is often the finding that settles the argument internally.
Adopt AI Partners builds these systems inside the organisation and stays until your team runs them without us. To walk through how this sits against your own backlog, write to hello@adoptaipartners.com.