The request arrived at 4:47 on a Thursday afternoon. A journalist had filed a public-records request, defined in this context as a formal written demand under an open-government statute for agency documents, fourteen days earlier. The subject: body-worn camera (BWC) footage from a use-of-force incident involving two officers, a parking structure, and a subject who had been hospitalized. The records supervisor, Diane Okafor, had inherited the request from a colleague who left the unit mid-cycle. She had the footage. She had the case file. She had a legal review deadline in forty-eight hours. And she had a redaction queue that currently held twenty-two other open requests, some of which were ninety days old. The AI-assisted redaction platform had already auto-flagged faces in the footage and proposed blur regions. The question was not whether the tool could help. The question was how to run the request-to-release workflow correctly from intake to delivery so that the release neither violated anyone's privacy nor withheld anything the law required to be disclosed.

The Anatomy of a Public-Records Request

A public-records request is not a letter to be answered when time permits. It is a legal trigger. The moment a request is received, a statutory clock begins running. Depending on the jurisdiction, that clock may allow five business days for acknowledgment, ten days for a substantive response, or some other interval set by state or local law. Missing a deadline is not just a customer-service failure. It can expose the agency to lawsuit, to fee awards for the requester, and to court orders compelling release of material the agency might have had legitimate grounds to withhold if it had moved on time.

Diane understood this. She had worked the records unit long enough to have watched a supervisor lose a case not because the agency had something to hide, but because the response was fourteen days late and the requestor's attorney had been waiting. The court found the delay without legal justification and awarded the requestor attorney fees. The agency spent more defending the process failure than it would have spent releasing the records.

A public-records request for law enforcement material commonly covers several categories of documents. The first is raw footage: BWC recordings, dashcam recordings, surveillance footage from agency-owned cameras, and booking photographs. The second is written records: incident reports, supplemental reports, use-of-force reports, arrest reports, the CAD (computer-aided dispatch) entry, and the RMS (records management system) report, which is the agency's formal structured record of the incident. The third is audio: 911 calls, radio transmissions, and interview recordings. The fourth is administrative and analytical documents: use-of-force review forms, citizen complaint records, disciplinary records that may or may not be disclosable depending on jurisdiction, and training records.

Each category carries different legal treatment. Some records are presumptively public. Others are presumptively exempt: juvenile records, confidential informant information, active-investigation materials, and in many jurisdictions certain personnel records. The records clerk or supervisor processing the request must identify what has been requested, determine what exists, assess each item against the applicable exemptions, make a release or withhold decision on each item, apply redactions to any item being partially released, and document the legal basis for every withholding and every redaction.

A public-records request is a legal trigger with a statutory clock. Running the workflow correctly from the moment the request is received is not optional courtesy; it is the agency's legal obligation and its protection against the most avoidable form of records litigation.

What AI Can and Cannot Do in Intake

At the intake stage, AI-assisted tools can do several things well. They can log the request, extract the requester's contact information, parse the description of the records sought, cross-reference it against existing case numbers and CAD incident numbers, and auto-populate the tracking record in the records management system. This is genuine administrative relief. In a busy records unit handling dozens of concurrent requests, the logging and routing work alone consumes significant time, and automated intake reduces that burden.

What AI cannot reliably do at intake is make legal determinations. Whether a document is responsive to the request depends on its content, not just its category. Whether a responsive document qualifies for an exemption is a legal question that turns on jurisdiction-specific statute, case law, and agency policy. The AI system can flag potential candidates and propose exemption categories based on metadata, but the legal determination must be made by a human with authority to make it: the records supervisor, the agency's legal counsel, or both.

Diane's platform, in the Okafor scenario, had already associated the request with the incident number and pulled the relevant footage, reports, and CAD entry into a release package. That step had taken less than three minutes. In a manual workflow, the same step would have taken twenty to forty minutes of searching, cross-referencing, and file-pulling. The time saving was real. The legal work still lay ahead.

The Redaction Decision Tree

Redaction, in the law enforcement context, is the process of removing or obscuring information from a record before release because that information falls within a recognized exemption. Redaction is not the same as withholding. Withholding means the entire document is not released. Redaction means the document is released with exempt portions removed, allowing the requestor to receive the disclosable information while protecting the exempt information.

In the context of BWC footage, redaction applies primarily to faces, license plates, and any other identifying information belonging to third parties, meaning individuals who were not parties to the incident (witnesses, bystanders, uninvolved residents), and to the faces of minors regardless of their role in the incident. Most jurisdictions also require redaction of medical information visible in the footage. In written records, redaction covers Social Security numbers, driver's license numbers, dates of birth in many contexts, victim and witness contact information in cases where disclosure would endanger them, and juvenile identifying information.

Two failure modes exist in redaction, and both carry legal and ethical weight. Over-redaction means the agency withholds more than the law permits. The officer's face in use-of-force footage is generally not exempt: officers acting in an official capacity do not have the same privacy interest in their identity as private citizens, and many courts have held that redacting an officer's face in a use-of-force release is an impermissible over-redaction that obstructs accountability. Under-redaction means the agency releases information it should have protected. A single visible face of an uninvolved bystander in a domestic violence call can expose that person to retaliation, can violate state privacy law, and can expose the agency to civil liability. A visible minor's face in any release is a serious under-redaction that can trigger state statutory consequences.

The AI Redaction Proposal as a Draft, Not a Decision

The AI-assisted redaction tool in Diane's platform had proposed blur regions for sixteen faces in the footage. It had flagged three license plates. It had not flagged two faces that appeared briefly in low-light conditions in the second clip, where the AI's confidence score was below threshold. It had also proposed blurring the face of Officer Chen, which would have been an over-redaction under the jurisdiction's case law on officer-accountability releases.

This is the operational reality of AI-assisted redaction: the tool produces a redaction proposal, not a redaction decision. The proposal is a starting point that is faster than a manual review, but it is not the final product. The human reviewer must do three things with the AI proposal. First, accept confirmed correct detections: the sixteen faces the AI found in normal lighting are a reasonable starting point. Second, catch what the AI missed: the two low-confidence faces in the second clip require a manual review frame by frame until the reviewer is satisfied they are adequately redacted. Third, reverse incorrect proposals: the proposal to blur Officer Chen's face must be removed because it would constitute an over-redaction and, under the agency's policy and the jurisdiction's case law, would not withstand a legal challenge.

The review pass for Diane's package took forty-two minutes. A fully manual review of the same footage would have taken, by the unit's internal estimates, between three and five hours depending on the clip length and the density of faces. The AI draft had saved time. The human review had ensured the release was legally defensible.

Written Records in the Release Package

The footage was only part of what the journalist had requested. The request also covered the incident report, the use-of-force report, and the CAD entry. Diane's platform had already assembled these documents. The legal review was more complex for the written records than for the footage.

The incident report and use-of-force report contained the names of the responding officers. In this jurisdiction, officer names in official capacity actions are presumptively public. They were not redacted. The reports also contained the full name, date of birth, and home address of the subject of the use-of-force incident. The subject's name was disclosable (he had been arrested). The date of birth required a redaction under the jurisdiction's personal information exemption. The home address was also exempt and was redacted.

The use-of-force report also contained a reference to a witness whose identity had been designated confidential by the investigating detective pending the administrative review. The witness's name and any identifying information were redacted, and the withheld information was logged with the specific exemption cited in the agency's public-records policy.

The CAD entry was released in full. It did not contain exempt information. The call-type classification, the dispatch timestamp, the unit assignments, and the notes entered by the telecommunicator were all disclosable.

The Exemption Log

Every redaction and every withholding requires documentation. This is not a bureaucratic formality. It is the agency's legal defense if the requestor challenges the release. A requestor who receives a partially redacted document can file a petition demanding that the agency justify each redaction. If the agency cannot produce a specific, documented legal basis for each redaction, the court may order the material released and may award attorney fees.

Diane's platform automatically generated a redaction log as she worked, capturing the document, the location of each redaction, and a dropdown-selectable exemption category. She was also required to add a brief narrative justification for each non-standard redaction: the confidential witness, the over-redaction reversal for Officer Chen, and a section of the use-of-force report that contained preliminary investigative notes that the detective had flagged as potentially exempt under the active-investigation exemption. For that last item, Diane placed a legal hold and forwarded it to the agency's legal counsel with a seventy-two-hour turnaround request, noting the release deadline.

The exemption log is also important as an AI-disclosure document. If the redaction proposal was generated by an AI tool, and the agency's jurisdiction or prosecutor requires disclosure of AI use in the records process, the log captures that the AI tool proposed the redaction and that a human reviewer accepted, rejected, or modified each proposal. That is the audit trail. It is the agency's answer to a challenge that the redaction was arbitrary, automated, or incorrect.

The Release Review: The Four-Corners Check

Before any release package leaves the records unit, it goes through what practitioners in this field call a four-corners check: a final read of the entire package, corner to corner, as though you were the requester receiving it and the most aggressive attorney challenging it.

The four-corners check asks four questions. First: is everything in this package actually responsive to what was requested, no more and no less? Over-inclusion of non-responsive materials can inadvertently disclose information that should not have been included. Under-inclusion means the agency is withholding disclosable material, which is a Brady problem in the criminal case context and a public-records violation in the disclosure context.

Second: does every redaction have a logged basis? Go through the redaction log against the package. Every blurred face or license plate in the footage, every black bar in the written record, should have an entry in the log with the exemption cited. If it does not, the release is not ready.

Third: is there any information in the package that should have been redacted but was not? This is the under-redaction check. In footage, it means watching a final pass specifically for unredacted faces, license plates, medical information visible on screen, and any other potentially exempt visual content. In written records, it means reading for personal information fields that may have been missed: partial Social Security numbers, phone numbers, email addresses, medical record references.

Fourth: does the cover letter accurately state what is being released, what is being withheld, and the legal basis for each withholding? The cover letter is the first document the requester and their attorney will read. If it misstates what is in the package or fails to state the grounds for any withholding, it creates an opening for a challenge even if the underlying release decisions were correct.

The AI-Assisted Final Scan

Several platforms now include a final-scan feature that runs the release package through the AI redaction detection tool one more time before release, specifically looking for any identifiable information the initial proposal may have missed. This scan is not a replacement for the human four-corners check. It is a supplement. The AI may catch a face in the final clip that the human reviewer inadvertently skimmed. The human reviewer may catch a redaction-log gap that the AI scan does not flag because the gap is a process issue, not a content issue.

Diane ran the final scan on her package. It flagged one additional face, in the second clip, at a timestamp her manual review had covered but where the AI's confidence had now reached threshold because the frame was clearer in the stabilized version of the clip. She accepted the new blur region. She then completed the human four-corners check and found no additional issues. The package was ready.

The total time from intake to release-ready: four hours and eighteen minutes, spread across two days including the legal hold on the preliminary investigation notes. In the unit's pre-AI workflow, a package of this complexity typically required eight to twelve hours over three to five days, not counting the legal hold time, which was the same in both workflows. The AI-assisted workflow had cut the records clerk's working time roughly in half while producing a more thoroughly documented release than the prior manual process.

What Goes Wrong: Failure Modes in the Release Workflow

Understanding the failure modes in the request-to-release workflow is as important as understanding the correct steps. The failures cluster into four patterns, and each one has a distinct cause and a distinct remedy.

The first failure mode is missed faces and plates in footage. This is the most common under-redaction failure in AI-assisted release workflows. The AI detection system has a confidence threshold. Faces or plates that appear in poor lighting, at unusual angles, at the edge of the frame, in motion blur, or for only a few frames frequently fall below the threshold and are not flagged. The remedy is the manual final-scan pass specifically targeting these conditions: low-light sequences, fast-movement sequences, wide-angle frames where peripheral figures may appear, and any sequence where the AI confidence scores are visible and show anything below a defined threshold.

The second failure mode is officer-face over-redaction. As described above, redacting an officer's face in an on-duty accountability release is an over-redaction in most jurisdictions. Some AI tools will flag officer faces by default if they are not pre-trained to distinguish officer from civilian faces, or if the agency has not configured the tool to preserve officer-face visibility in accountability releases. This is a configuration and policy issue, not an AI capability issue: the tool needs to be told the policy, and the reviewer needs to verify the tool is following it.

The third failure mode is exemption-log gaps. The reviewer accepts or rejects a redaction proposal but does not document the basis for the decision. The release goes out with a redaction log that has blank entries. When challenged, the agency cannot reconstruct why specific information was redacted. In the worst case, this can result in a court finding that the redactions were arbitrary and ordering the full unredacted material released.

The fourth failure mode is deadline creep from unresolved legal holds. The records unit holds a segment of material for legal review and then loses track of the deadline. The legal hold extends past the statutory response period because no one is actively managing the calendar. The requester's deadline passes, the agency is technically in violation, and the legal hold that would have protected the exemption is no longer available as a defense because the overall response was untimely. The remedy is active deadline management: every open legal hold should have a specific resolution date that is tracked in the records management system and flagged if it approaches the statutory deadline.

The CJIS Dimension and Data Handling

The CJIS (Criminal Justice Information Services) Security Policy governs the handling of criminal justice information, including the records and footage that flow through the request-to-release workflow. CJIS obligations do not transfer to the vendor when the agency uses a third-party AI platform. The agency is the CJIS-covered entity. The agency owns the obligation to ensure that data processed by the AI tool is handled in compliance with the CJIS Security Policy: access controls, audit logging, encryption in transit and at rest, and personnel security requirements for anyone with access to CJIS-covered data.

When an agency uses an AI-assisted redaction or release platform, it is responsible for ensuring the vendor has executed the appropriate data-use agreement and that the vendor's handling of CJIS data meets or exceeds the CJIS requirements. A vendor that stores footage, runs it through a cloud-based redaction model, and returns the redacted version is touching CJIS-covered data. The agency must verify, through contract and audit, that the vendor's infrastructure meets the CJIS requirements. If the vendor cannot demonstrate compliance, the agency cannot use the tool for CJIS-covered material regardless of its commercial appeal.

Diane's platform had a current CJIS compliance certification and a data-use agreement on file. The data was processed in a dedicated government cloud environment, not on shared commercial infrastructure. The agency's CJIS Systems Agency (CSA) had reviewed and approved the vendor configuration before deployment. This compliance work had been done before the first record was processed. It had to be. Using a non-compliant tool for CJIS data is not a technology error; it is a policy and legal violation that the CJIS obligations make the agency's problem, not the vendor's.

The Disclosure Note and the Release Letter

The final step in the workflow is the release letter. This document accompanies the package, states what is being provided, identifies what is being withheld and on what grounds, and, where agency policy or prosecutor policy requires it, notes that AI-assisted tools were used in the redaction process and that every redaction was reviewed and approved by a human reviewer.

The AI disclosure note in a release letter serves two purposes. The first is transparency: the requester and any downstream attorney knows the process the agency used to assemble the package. If a redaction is challenged, the agency can demonstrate that it used a documented, human-reviewed process rather than a black-box automated one. The second purpose is prophylactic: disclosing the AI use at the time of release prevents a much more damaging later disclosure in litigation where an opposing counsel discovers the AI use was not documented and argues that it was concealed.

The release letter Diane drafted stated: "This package has been assembled and redacted using agency-standard records procedures. AI-assisted redaction tools were used in the preparation of this release. All redaction proposals generated by the AI tool were reviewed and approved or modified by a qualified records reviewer. The final release reflects the reviewer's determinations. A complete redaction log documenting the basis for each redaction is maintained in the agency's records management system and is available upon request in a subsequent public-records filing."

That language accomplishes three things. It affirms human authorship of the release decisions. It documents AI use without overstating it. And it points to the audit trail, which is the most important single element of the agency's defense if the release is challenged.

The journalist received the package twenty-three hours before the statutory deadline. The release included the full, partially redacted footage (officer faces visible, third-party faces blurred, one minor's face blurred), the incident report with date-of-birth and home-address redactions, the use-of-force report with the confidential witness information redacted, the CAD entry in full, and the cover letter. The section of the use-of-force report subject to the legal hold was withheld, with the grounds stated in the cover letter as "preliminary investigative notes subject to active-investigation exemption, currently under legal review."

The journalist published the story. It included the footage. It did not challenge the redactions. Two months later, the subject of the incident filed a civil complaint. The agency's legal team, assembling the litigation file, found the complete redaction log, the AI disclosure note, the reviewer's acceptance and rejection records, and the legal hold documentation. The litigation file was complete. The release had been done correctly, and the record showed it.

Key Takeaways

• A public-records request is a legal trigger, not a courtesy request. The statutory clock begins at receipt, and a late response without legal justification can cost the agency more in attorney fees and court orders than the cost of releasing the records in the first place.
• AI-assisted intake and routing can save twenty to forty minutes per request in logging, cross-referencing, and package assembly. The time saving is real, but the legal review, exemption analysis, and release decision still require human authority.
• The AI redaction proposal is a draft, not a decision. The human reviewer must accept confirmed detections, catch what the AI missed (low-light faces, peripheral figures, rapid-motion frames), and reverse incorrect proposals, including the officer-face over-redaction that a misconfigured tool will often produce.
• Over-redaction and under-redaction are both failures. Blurring an on-duty officer's face in an accountability release is an over-redaction that obstructs accountability and will not survive legal challenge in most jurisdictions. Missing a bystander's face or a minor's face is an under-redaction that can trigger civil liability and state statutory consequences.
• Every redaction must have a logged basis citing the specific exemption. The exemption log is the agency's legal defense when a redaction is challenged. Blank entries in the log are as dangerous as missed redactions.
• CJIS obligations stay with the agency, not the vendor. Any third-party AI tool that processes footage or reports must operate under a current data-use agreement with a demonstrated CJIS-compliant infrastructure, approved by the agency's CJIS Systems Agency before the tool is deployed.
• The four-corners check before any release goes out: is the package correctly scoped, does every redaction have a logged basis, is there any unredacted exempt information, and does the cover letter accurately state what is released, what is withheld, and why?
• The AI disclosure note in the release letter is not optional where agency or prosecutor policy requires it. It is the agency's transparency record and its prophylactic protection against a litigation discovery finding that AI use was concealed.