Government

Public Records Requests in the AI Era: How Records Teams Keep Up

Requesters now use AI to search and compare released records at scale. Records teams can use AI too, to find records, flag sensitive data, and keep redactions consistent, while people stay accountable for every disclosure decision.

By Roshnee Sharma · CEO, Autessa

Public-records work is a public trust. Agencies have a responsibility to make records available, explain their decisions, and protect information that should not be released.

That balance is getting harder to hold. Requesters can now search, compare, and analyze released records at scale. Lean records teams still have to find responsive documents, make defensible redaction decisions, and deliver consistent responses across a growing body of work.

In short: AI can increase the pressure on public-records operations, but it can also help agencies respond with more consistency. The right use of AI is not to make disclosure decisions on its own. It is to help people find records, identify potential sensitive information, compare prior decisions, and preserve an audit trail for every release.

What does FOIA require, and where does judgment begin?

The federal Freedom of Information Act gives the public the right to request records from federal agencies, and it is often described as the law that keeps citizens informed about their government. Federal agencies must disclose requested records unless an exemption applies, and they must release any reasonably segregable portion of a record that is not exempt. The law identifies nine exemptions, including protections for personal privacy, law enforcement interests, national security, and confidential commercial information.

FOIA applies to federal agencies. State and local governments are generally governed by their own public-records laws, which differ by jurisdiction. That distinction matters. A city clerk, a county records officer, or a state agency should work from the laws, regulations, retention schedules, and disclosure guidance that apply to their own organization.

The underlying responsibility is the same everywhere: openness where the law requires it, and careful protection where disclosure would cause harm.

That protection can involve more than obvious personal information. A responsive record may include names, home addresses, phone numbers, medical details, account numbers, security procedures, bid information, law enforcement material, or data that reveals more in combination than it does alone. A single document can also contain information that must be withheld right next to information that should be released.

This is why redaction is not a clerical step. It is a legal and operational decision. The agency needs to be able to explain what it released, what it withheld, why it made that decision, and who approved it.

Why are public-records teams under more pressure now?

A requester no longer needs to read thousands of pages by hand to find patterns. Widely available AI tools can summarize batches of documents, compare one release against another, extract names and dates, and point out what appears to be an inconsistent redaction.

That is not inherently a problem. Public access and scrutiny are central to accountable government. But it changes the operating environment for the teams that process requests.

One missed identifier in a scanned PDF can be copied and redistributed quickly. One inconsistent decision across similar records can invite follow-up requests, appeals, or public attention. A pattern that was once difficult to spot across months of releases can now be found in minutes.

Some organizations also face repeated or overlapping requests from the same parties. Fees may offset some direct costs where the applicable law allows them, but they do not resolve the core workload of locating records, reviewing them, applying the right exemptions, preparing releasable copies, and documenting the outcome.

The risk compounds when records work is spread across departments. One team receives email exports, another holds contract files, and a third manages incident reports, call recordings, photographs, or scanned forms. Without a shared process, each reviewer is forced to begin from scratch.

The result is familiar. Experienced staff spend hours rereading similar material, hunting for prior releases, and checking whether a comparable record was redacted differently. That time should go to the difficult work, which means resolving close calls, correcting source records, protecting people, and helping the public get an accurate response.

What should AI do in a defensible records process?

AI should support the people who are accountable for disclosure decisions. It should not replace them.

A practical system begins with intake. Teams need to capture the request, scope it clearly, assign owners, and connect it to the relevant departments and record systems. Search should then work across the formats records teams actually receive, including email threads, PDFs, spreadsheets, scanned forms, images, audio transcripts, and case files.

A defensible public-records workflow A request moves through five steps: intake and scoping, search across formats, flagging of potentially sensitive data, a human reviewer who decides, and release. Low-confidence items loop back from the flagging step to the reviewer. An audit trail runs underneath every step and records the original document, the proposed and approved redactions, the exemptions used, and the release version. AI ASSISTS A PERSON DECIDES Intake Scope the request and assign owners. Search Email, PDFs, scans, audio, and case files. Flag Sensitive data and prior decisions. Reviewer Applies exemptions and approves. Release A versioned copy goes out. Low confidence goes to a person. AUDIT TRAIL It keeps the original file, every proposed and approved redaction, the exemptions, override notes, and the release version.
AI speeds up the search and flagging steps, but a person applies the exemptions and approves the release. The audit trail ties every step together.

From there, AI can assist with repeatable, reviewable tasks:

  • It can find likely responsive material. The system searches released and unreleased records using the language of the request, along with related dates, people, locations, projects, and case identifiers.
  • It can flag potentially sensitive data. The system identifies likely names, addresses, account numbers, Social Security numbers, payment card data, medical references, and other categories that need review under the applicable law and policy.
  • It can surface similar prior decisions. Reviewers see how comparable language or document types were handled before, including the exemption or legal basis that was used.
  • It can build a review queue. Documents with heavy concentrations of sensitive data, conflicting signals, low-confidence classifications, or unusual formats move to the front.
  • It can check for consistency. Proposed redactions are compared with previous releases, and differences are flagged for a reviewer to investigate.
  • It can preserve the record of the decision. The original document, the proposed and approved redactions, reviewer actions, policy or exemption references, the release version, and timestamps all stay together.

The reviewer remains responsible for the decision. That matters most when context changes the meaning of a record. A string of numbers may be a harmless internal reference in one document and an account number in another. A name may be releasable in one setting and protected in another. No automated system removes the need for legal authority, subject-matter context, and human judgment.

What AI handles and what the reviewer owns Two columns. AI handles finding likely responsive records, flagging potentially sensitive values, surfacing similar prior decisions, ordering the review queue, and checking proposed redactions against past releases. The reviewer owns the disclosure decision, the exemption or legal basis, close calls that depend on context, overrides with a written rationale, and final approval of the release. AI handles the repetition It finds likely responsive records. It flags potentially sensitive values. It surfaces similar prior decisions. It orders the review queue by risk. It compares redactions to past releases. The reviewer owns the decision They decide what is disclosed. They choose the exemption or legal basis. They resolve close calls using context. They record a rationale for overrides. They approve the final release.
The split that keeps a records process defensible is simple. AI takes the repetitive work, and the reviewer keeps every judgment call.

A defensible workflow also makes uncertainty visible. If the system cannot classify a piece of information confidently, it should route that record to a person. If a reviewer overrides a recommendation, the system should record the override and the rationale. If a policy changes, teams should be able to identify the releases and work queues that the change affects.

How do agencies build consistency without slowing disclosure?

Consistency does not mean treating every record as identical. It means handling similar facts through a documented process and making exceptions visible.

Start with a practical redaction policy library. It can include approved categories of sensitive information, the relevant statutes or exemptions, agency-specific rules, examples of approved redactions, and escalation paths for difficult cases. Keep it current, and make it accessible to every authorized reviewer.

Next, build a searchable history of releases and decisions. When a new request arrives, reviewers should be able to find prior responses that involve the same project, vendor, address, incident type, or record category. They should not have to rely on memory or ask around for the latest version of a spreadsheet.

Version control matters here. Agencies need to know which copy was reviewed, which redactions were approved, and which version was released. A change should never silently overwrite a prior decision. For high-risk releases, add a second reviewer or an approval step before delivery.

Finally, measure the work that creates risk. Track where requests stall, which record types generate the most manual review, where reviewers disagree, and which redaction categories are repeatedly missed or overridden. These numbers are more than productivity metrics. They show where policies, training, source systems, or staffing need attention.

The goal is not to process more pages for its own sake. The goal is to make timely, lawful disclosure more sustainable while protecting the information an agency has a duty to protect.

What should public-records teams do next?

Start by mapping one request from intake to release. Identify where staff repeatedly search for the same records, manually inspect the same fields, or struggle to find a previous decision. Those are the best places to introduce controlled automation.

Then set guardrails that are not up for negotiation: human approval for disclosure decisions, role-based access, version control, documented policies, and a complete audit trail. Test any AI workflow against real record types before you expand it, and include the hard cases rather than only clean digital documents.

Autessa gives records teams a governed environment where AI agents search, flag, and compare records inside the agency's own cloud, while reviewers approve every release and every step lands in an audit trail. If your team is facing more requests with the same staff, we would be glad to walk through one of your workflows with you.

This post is general information, not legal advice. Public-records obligations vary by agency and jurisdiction, so confirm your process with your own counsel.

Sources