Watch this space for interesting product updates and discussions on relevant topics.
At AMS we hear a similar story with most new customers. A single Subject Access Request (SAR) has changed dramatically in the last year or so. They are now more complex than ever with the emergence of requesters using AI to write the Subject Access Request.
If processing a Staff SAR for example, it can mean working through hundreds of emails, many of them repeated across long chains and mixed in with details that may need to be redacted. Requests like these are reported to be rising, adding to the growing pressure Information Governance teams face from both Subject Access Requests (SARs) and Freedom of Information requests (FOIs). SARs, including requests for health records, must normally be answered within one month, and FOIs within 20 working days. These time frames are becoming more difficult with the recent increase in complexity of received requests.
For the people making them, SARs are often very important. It might be a patient who wants to see their medical records or an employee who has fallen out with their employer and wants to know what was written about them. A late reply can be frustrating for them, and it adds to the pressure on the IG team handling the request.
Missed deadlines can carry consequences. Problems with Subject Access Requests are the most common reason people complain to the ICO (now the Information Commission). The ICO has also taken enforcement action against organisations that failed to answer SARs on time, which can damage reputations as well as compliance records.
However, AI can automate parts of request management for both SARs and FOIs to ease some of that pressure. The question is not whether it can help, but which tasks it should handle, check or suggest, while making sure people stay firmly in control.
Where AI could help - Fighting Fire with Fire
Much of the pressure on request teams comes from the volume of requests, and more recently, the complexity of those requests rather than difficult decisions having to be made by the case handlers. According to Cabinet Office figures published in April, Freedom of Information requests to central government alone reached a record 94,526 in 2025, more than double the number received in 2020. Each one must be gathered, read and checked before anyone can decide what to release. Digital tools are already easing that load: One NHS Trust that moved it's SAR process online reports saving around 45 minutes per request.
AI automation in Request Management could further help IG teams, and there are a few specific places in the process it could assist.
When gathering all the documents that may need to be disclosed to the requester. Take a typical SAR involving email. The same emails often appear many times across replies and forwards, and in some teams each one is still converted to PDF by hand before it can be reviewed. Automatically converting emails into a single PDF, alongside an AI tool that recognises duplicates and pieces chains back together, could turn hours of preparation into a much shorter task and help reviewers more quickly understand a long and complex email thread.
AI could also help with an FOI problem. Some FOI requests ask for information that may already have been published. The Freedom of Information Act exempts information that is reasonably accessible elsewhere, including through an organisation's publication scheme, but someone still has to find it. AI could search through any relevant published material so the team can point the requester to an answer that already exists.
Reviewing documents may be where AI can help most. An initial AI scan could pick out potential redactions, such as names, initials and other third-party information, and flag documents that may fall outside the scope of the request. The IG officer then confirms or rejects each suggestion, ensuring every decision is made by a trained professional. It may even improve quality: a person reading hundreds of pages is more likely to miss a set of initials than a tool, which applies the same checks throughout each document, no matter the length.
Where it could go wrong
Sceptics argue that any new tool handling personal data adds risk that stretched IG teams can do without, and it is a fair point. As with most technology, AI implementation in request management carries risks, and many of them stem from over-reliance. Misread context or irrelevant documents can slip through, and if suggestions are accepted unchecked, a missed redaction could expose a patient's or colleague's information.
The subtler risk is that good tools invite trust. The more often an AI suggestion is right, the easier it becomes to stop questioning it. The ICO has warned about this automation bias and has been clear that approving an AI output without properly checking it is not meaningful review.
There is also a limit to what pattern matching can do. AI can be good at finding names, but it is harder to judge which ones should be redacted. A manager's name on a routine email may be fine to disclose, while a comment about a colleague's personal circumstances may not. Those are the judgements IG professionals are trained to make.
IG teams will also want to know what happens to the data. Where does the AI tool process it, how long is it kept, and is it ever used to train the tool? The organisation will need to carry out a data protection impact assessment before an AI tool goes live.
Requesters' trust matters as well, particularly for employees already in dispute with their organisation. Being open about how AI is used and being able to show that professionals made the final decisions are both important to keeping that trust.
How much these risks matter depends largely on how AI is introduced. Many can be reduced with the right implementation: AI suggests, a person decides, and every decision is recorded as evidence if a disclosure is ever challenged.
Finding the balance
Weighed together, the case for AI is strong, provided it supports people and reduces stress on the teams involved in this process. Its greatest value lies in taking on the preparation and checking that slows the request process down, giving skilled IG staff more time for the judgements only they can make, and getting answers to requesters sooner.
For organisations considering AI, the best place to start is where the most time is lost and a person still checks every result, such as converting and de-duplicating long email chains and suggesting redactions for an officer to confirm or reject. Keeping an eye on time per request and deadlines met will show fairly quickly whether it is helping.
Before signing up to any AI tool, it is worth asking how it protects the integrity of the process, and whether it leaves the evidence needed to defend a disclosure later. Can every suggestion be checked and overridden? Is there a record of what the AI suggested and what a person decided? Where is the data processed, and is it used for anything else?
Used well, AI will not take decisions away from IG teams. It will free up time to make those decisions properly, whilst reducing stress on the teams involved.
