FOIA in the AI Era: How Agencies Are Cutting Redaction Time from Weeks to Hours
The federal government spent an estimated $500M on FOIA processing in 2024. Most of it was manual redaction. The DOJ FOIA backlog exceeded 100,000 requests. HHS documented that its CMS division explored AI-powered redaction because manual processing was creating unacceptable backlogs. ARPA-H explicitly sought AI redaction software in 2025 to "leverage artificial intelligence to perform redactions and utilize e-discovery for due diligence."
The recognition that manual FOIA redaction cannot scale is now institutional. The question has shifted from "should we automate?" to "how do we implement automation that produces defensible, court-admissible output?"
The Federal FOIA Backlog Crisis
Under 5 U.S.C. §552, federal agencies must respond to FOIA requests within 20 business days. Agencies can invoke "unusual circumstances" to extend the deadline with notice to the requester. In practice, many agencies operate with response times measured in months to years, not days.
The DOJ backlog of 100,000+ requests represents approximately 2 billion minutes of manual review time if each request involves just 20 minutes of review. At government billing rates, that's billions of dollars in labor — most of it for mechanical identification and redaction of standard PII.
The requests driving the backlog are not complex legal questions requiring attorney judgment. They're document-heavy requests where 80% of the work is running a highlighter across thousands of pages looking for names, addresses, and phone numbers — work that an algorithm performs in seconds.
What ARPA-H and HHS Recognized
ARPA-H (Advanced Research Projects Agency for Health) issued a procurement seeking AI redaction software specifically designed to handle FOIA document processing. The requirements:
- Automatic identification and redaction of FOIA Exemption 6 and 7(C) PII
- Batch processing of large document sets
- Mixed format support (PDF, Word, email formats)
- Audit trail documentation
- Defensible output appropriate for FOIA response
HHS/CMS documented similar requirements in their operational review, noting that the combination of growing request volumes and static staffing made manual processing mathematically unsustainable.
These are not agencies pursuing cutting-edge AI for its own sake. They're agencies facing a statutory compliance crisis and recognizing that the solution requires automation.
State and Local Government: The Underserved Problem
The federal government's FOIA challenge is large but resourced — agencies have dedicated FOIA offices, budget for legal review, and established workflows. State and local governments face the same statutory obligations with a fraction of the resources.
California's CPRA (California Public Records Act) requires responses within 10 calendar days. A county with a 3-person legal team cannot absorb a 2,000-document records request within that window through manual review. The choices are:
- Deny or delay (creating legal exposure)
- Hire temporary legal staff for large requests (expensive, slow to onboard)
- Automate the mechanical redaction phase
Option 3 is now viable. The same batch processing capability available to federal agencies is accessible to county legal departments without enterprise procurement timelines.
EU Member State DSAR: The Same Problem, Different Jurisdiction
GDPR Article 15 Data Subject Access Requests (DSARs) create a parallel challenge for EU organizations. Unlike FOIA (government-specific), DSAR obligations apply to all organizations processing personal data. A €10M annual revenue SaaS company can receive the same volume of DSARs as a large enterprise, with fewer resources to respond.
The practical DSAR challenge mirrors FOIA: produce all data held about a specific individual, with third-party PII redacted from the response, within 30 days. Each DSAR involving email archives, support tickets, and order records can require reviewing hundreds of documents for third-party redaction.
For organizations receiving 20-50 DSARs per month — a level that requires one or more FTE dedicated to DSAR response at current manual processing rates — batch automation reduces this to part-time work.
Desktop Application: Offline Government Processing
Government agencies handling classified or sensitive records face a constraint that web-based tools cannot address: data that cannot leave agency infrastructure.
The Desktop App (anonym.plus) addresses this directly:
- All processing occurs locally on the agency's hardware
- No data transmitted to external servers
- Batch processing of 1-5,000 files per run
- Mixed format support: PDF, DOCX, XLSX, TXT, CSV, JSON, XML
- ZIP packaging of processed files
- CSV/JSON export with per-file processing metadata
For agencies with air-gapped networks or strict data residency requirements, local processing is not optional — it's the only viable approach. The Desktop App provides the same detection accuracy (XLM-RoBERTa, 285+ entity types) in an offline environment.
Implementation Considerations for Government Contexts
Audit trail requirements: Government redaction workflows require documentation of what was redacted, on what basis, by whom, and when. Processing metadata from batch operations provides the first two elements. Routing through review workflows (exception review by agency staff) provides the latter two.
Consistency across document sets: FOIA responses that redact a name in some documents but not others create legal exposure. Automated processing with consistent configuration eliminates inconsistency introduced by different reviewers applying different judgment.
Sensitive but unclassified (SBU) handling: Many government documents are SBU rather than classified. Local processing handles SBU materials without network transmission. Web-based processing on EU-hosted servers with appropriate DPA agreements handles non-SBU materials.
Court-admissible redaction format: The Redact method (black bar replacement) matches the physical appearance of traditional FOIA redactions and is appropriate for court-admissible production. The replacement token approach ([REDACTED - Exemption 6]) with explicit exemption citation provides more granular documentation.
Conclusion
FOIA is a statutory requirement. The 20-business-day response deadline is not aspirational — failure to comply creates legal exposure and DPA/court intervention. When request volumes exceed the capacity of manual processing, systematic failures follow.
AI-powered batch redaction doesn't replace agency legal judgment. It eliminates the mechanical phase — identifying and removing standard PII in tens of thousands of documents — that consumes 70-80% of review time. Agency legal staff refocus on the 10-20% exception documents where context matters.
ARPA-H recognized this. HHS/CMS recognized this. The agencies facing the largest backlogs are moving toward automation. For state and local governments and EU organizations facing DSAR obligations, the same solution applies.
Sources: