How to manage an information request with AI

Start with a request control card

Before searching, turn the incoming message into a short control card:

| Field | Example | | --- | --- | | Requester | Customer administrator for Northstar workspace | | Requested information | Account activity for 1 to 15 August | | Purpose | Investigate an access concern | | Deadline | 22 August, 17:00 | | Systems in scope | Support inbox, audit log, account notes | | Authorization to verify | Admin role and account ownership | | Exclusions to review | Other users' personal information, security-sensitive details |

Ask AI to identify ambiguity, not to resolve it. A useful prompt is: “List the terms in this request that could change the search scope or disclosure decision. Do not infer authorization.” A human owner then confirms the request period, subject, systems, and permission basis.

This separation matters because the Information Commissioner’s Office treats recognizing a request, locating information, responding, and deciding whether information may be withheld as distinct parts of handling a subject access request. The exact legal duties depend on jurisdiction and circumstances, so the ICO guidance is a reference point, not a substitute for legal review.

Build a search record before drafting the answer

Create a source map with one row per system. Record the query used, the date searched, the operator, the number of results, and any inaccessible location. Let AI suggest synonyms and identifiers from the confirmed scope, such as an account ID, previous email address, or product name. Do not let it silently broaden the date range or decide that one repository is “probably enough.”

For the example request, the search record might show:

| Source | Search | Result | Follow-up | | --- | --- | --- | --- | | Audit log | Account ID + 1–15 Aug | 46 events | Export complete | | Support inbox | Account ID + known addresses | 3 threads | Review attachments | | Account notes | Workspace ID | 2 notes | One note mentions another user |

The response owner signs off on completeness only after every scoped source is searched or an exception is documented. “No result” is still a result and belongs in the log.

Review records item by item

Use three labels: release, redact, or escalate. AI may flag names, email addresses, credentials, internal security details, or content outside the requested period, but every flag requires review against the applicable policy and authorization. Keep the original record separate from the proposed redaction. This prevents a generated summary from becoming the only retained evidence.

A failure example is a support-thread summary that removes a colleague’s name but preserves a unique job title and quoted sentence. The response may still identify the person. The correction is to inspect the whole disclosure context, not just obvious identifiers.

Assemble a traceable response

The final packet should contain the plain-language response, the approved records, a description of unavailable material, and an internal source map. Every factual sentence in the response should point to a record ID or an explicit process note. The search log remains internal unless policy requires otherwise.

Before release, verify:

AI speeds up classification and drafting here. The defensible work is the human-owned chain from request to source, decision, and released response.

• the requester and authority were checked by an accountable person;
• the search matches the confirmed scope and all listed systems have a disposition;
• every redaction is reviewed in context;
• the response does not introduce facts from AI output that are absent from the records;
• dates, names, totals, attachments, and stated limitations match the evidence;
• the response and evidence packet have the required approval.

Sources and claim map

This resource is educational and operational. It does not provide legal advice or determine disclosure rights.

• Information Commissioner’s Office, Subject access request guidance: used for the distinction between recognizing, locating, responding to, and potentially withholding information in a subject access request.
• Information Commissioner’s Office, Request information from us: used as an example of publishing clear request routes and expectations.

Sources: [1] [2]