Every request logged, checked and on the clock the day it arrives, records found faster, and suggested exemptions and redactions laid out with reasons. The FOI officer decides what is released.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
Requests arrive by email, web form, post and, for environmental information, sometimes by phone. Each one has to be logged, checked as a valid request, sorted into FOI, EIR or a subject access request, and given a deadline. Many need clarifying. Some repeat a request already answered and published. More and more are written with AI tools, which can make them longer, broader, and sometimes wrong about the law.
Volumes are at a record high. Central government bodies received 94,526 FOI requests in 2025, the most since monitoring began in 2005. The work that takes the time is searching: emails, shared drives, case systems and now AI tools, because the ICO's 2026 guidance confirms that prompts and outputs used for work are recorded information. Then every page found has to be read, and personal data and other exempt material redacted.
The risks run both ways. Miss the 20 working day limit and the authority breaches the Act. Withhold too much and the decision is overturned at internal review or by the regulator. Release too much, such as a name left in a spreadsheet's hidden column, and it becomes a personal data breach. FOI teams are small, and the same few people carry all three risks.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Requests answered within 20 working days, or within a lawful extension, as published in the authority's FOI statistics.
ExampleUp from the published baseline
How long a request waits before it is logged, classified and given a deadline.
ExampleSame day
Officer and information-owner hours spent finding records.
ExampleDown by half
Personal or other exempt data released by mistake, including hidden content.
ExampleZero, with every near miss reviewed
Responses changed at internal review or by the regulator. A good measure of decision quality.
ExampleFalling, measured against last year
How often officers accept the suggested exemptions and redactions. Very high can mean people have stopped checking; very low means it isn't helping.
ExampleStable, and reviewed weekly
Cross-sector rules are on the UK regulation map.
A response is due within 20 working days. The authority must advise and assist requesters (section 16) and give reasons when it refuses (section 17). Requests are judged on what is asked, not who asks, so the assistant never sees the requester's identity when suggesting exemptions. Exemptions, the public interest test, the cost limit (section 12) and vexatious or repeated requests (section 14) are always a person's decision. Where section 36 applies, only the authority's qualified person can give the opinion.
Environmental information, such as planning, highways, pollution and land, falls under the EIR, not FOI. There is a presumption in favour of disclosure, requests can be made verbally, and the time limit can be extended to 40 working days only if a request is both complex and voluminous. The classifier is tested on spotting EIR requests, because handling one under the wrong regime means the wrong exceptions and time limits.
Public interest extensions should normally be no more than 20 extra working days, and internal reviews should normally be completed within 20 working days. The code also sets out which FOI statistics authorities publish, and larger authorities publish them quarterly. The workflow produces these figures from the case system, not from the AI.
Requests written with AI are still valid, even if they get the law wrong; the authority helps the requester correct them. Prompts and outputs used for work are recorded information, so this system's own logs and drafts can be requested, and official outputs belong in the corporate records system with a retention period. The ICO sees a role for AI in triage, search, summaries and redaction, provided the authority is confident nothing is improperly withheld.
Requests for the requester's own personal data are subject access requests and are routed to that process. Third-party personal data is withheld only where disclosure would breach the data protection principles, which a person decides. A DPIA is needed before the pilot, because the assistant reads large volumes of personal data in emails and files. Since 30 September 2026 the regulator has been the Information Commission.
In central government, a tool that suggests exemptions and redactions is likely to have a significant influence on a decision with public effect, so publish an ATRS record before the pilot ends. For councils it is voluntary, and for a transparency service it is a natural fit.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: email, forms, filesLog verbal EIR requests in the case system as today. The AI starts from the logged record. | Amazon SES, API Gateway, S3 | Logic Apps connectors, API Management, Blob Storage | Your mail server, Kong, Ceph or IONOS S3 Object Storage |
| Classification, summaries and draftingBoth clouds offer a choice of models, including Claude. Test on your own past requests, including AI-written ones. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Records search (retrieval)Search runs within the access granted for each request, not across everything. The disclosure log is indexed too, so repeat requests are spotted. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Reading documentsIncludes scanned papers, email attachments and spreadsheets with hidden sheets and columns. | Amazon Textract | Azure Content Understanding (includes Document Intelligence) | Open-source parsing (e.g. Docling) plus an open-weight vision model |
| Personal data detectionA first pass only. It finds names and identifiers; it can't judge whether a senior official's name should be released. That is the officer's call. | Amazon Comprehend (PII detection) | Azure Language in Foundry Tools (PII detection) | Open-source PII detection (e.g. Presidio) plus an open-weight model |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| Workflow and deadline clockWorking days and bank holidays from one calendar. Clarification and fee notices pause the clock, as the law allows. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Link to the FOI case systemThe case system stays the record of every request, decision and date. | API Gateway, plus your existing integration platform | API Management, plus your existing integration platform | Kong or your existing API gateway |
| Redaction and releaseSuggestions arrive as marked-up proposals. The officer applies redactions, and the release copy is flattened and checked for hidden content before it leaves. | In the FOI team's existing redaction tool | In the FOI team's existing redaction tool | In the FOI team's existing redaction tool |
| Guardrails | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protectionMailbox and file search rights are granted per request, time-limited and logged. They are never a standing permission. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every search, every suggestion and every decision with its reason. These logs can be requested under FOI too. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
File shares, the records system and older line-of-business systems often stay on your own servers, and so does the FOI case system in many authorities. The search index for on-prem records can sit beside them, so the bulk of the records never leaves your estate.
Uses cloud AI
Classification, drafting clarifications and suggesting exemptions run in a UK cloud region, working on the specific records collected for a request rather than the whole estate. If policy keeps everything in-house, open-weight models on your own GPUs do the same job.
How they connect
A private link (AWS Direct Connect or Azure ExpressRoute) and the API layer. Only the collected records for each request are sent, and suggestions come back as events onto your queue.
If the link drops
Requests are still logged and the deadline clock keeps running in the case system. Officers search and redact by hand, as they did before, and suggestions catch up when the link returns. A deadline never depends on the AI being up.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Intake agent
Where a person signs offAn FOI officer confirms the classification and deadline of every request, and sends every clarification. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
Review assistant
Where a person signs offThe FOI officer decides every exemption, public interest balance and redaction, with the qualified person or senior sign-off where needed. A person checks the final release copy before it is sent.
The FOI case system stays the record of every request, deadline, decision and response. The AI writes classifications and suggestions into it through the API layer, and officers see them where they already work.
Searching mailboxes and file shares is the most sensitive part of the design. The search runs under a service identity that is granted access for one request at a time, by the FOI team, and every query is logged. It never has standing access to everyone's email.
Events keep the AI decoupled. Each new request, and each batch of collected records, becomes a message on a queue with a unique ID. If a system is slow, work waits safely and nothing is logged twice. The deadline clock lives in the case system, so pausing the AI never pauses a deadline.
The disclosure log and publication scheme are published by the FOI team once a response is sent. Indexing them lets the intake agent point repeat requests to what is already public.
Map today's process from the case system data, measure the baseline, list where records live and who owns them, and agree how search access will be granted and logged.
Gate · must be true to passBaseline agreed, records map and access model approved, DPIA started, legal and information governance involved.
Intake and search for one or two services, in shadow mode: the AI classifies, searches and suggests, officers work as normal, and the two are compared on real requests.
Gate · must be true to passClassification and search recall within agreed limits, no exempt data missed in the audit sample, ATRS record drafted, senior information risk owner sign-off.
Intake and search go live for the pilot services, with monitoring, support and a rollback plan. Exemption and redaction suggestions follow once their own shadow results are agreed.
Gate · must be true to passMonitoring, support model, rollback plan, pre-release checks and officer training in place.
Add services and record stores one at a time, then reuse the pattern for subject access requests and internal reviews.
Gate · must be true to passEach new service passes the same pilot gate.
| Activity | Senior information risk owner | Information rights manager | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Legal | DPO & records management | SecurityI can fill this |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Informed | Consulted | Informed |
| Target architecture and integration | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Informed | Consulted | Consulted |
| Search access model and logging | Accountable | Consulted | Responsible | Consulted | Responsible | Consulted | Consulted | Responsible |
| DPIA, retention rules and ATRS record | Accountable | Consulted | Consulted | Informed | Informed | Consulted | Responsible | Consulted |
| Build and integration | Informed | Consulted | Accountable | Responsible | Responsible | Informed | Informed | Consulted |
| Testing on real past requests | Informed | Accountable | Responsible | Consulted | Responsible | Consulted | Consulted | Informed |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Consulted | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the target architecture, the search access model, the integration with your FOI case system and records stores, and the gates, with the DPIA and ATRS record built in from discovery. I'd report to your senior information risk owner and programme board.
Option B
If your digital team or delivery partner already has an architect, I'd take on the search, document reading and agents under their lead, and give them a second senior opinion on security, records management and how the design will stand up at internal review.
Goes wrong
A redacted PDF still holds the text under the black boxes, or a spreadsheet keeps a hidden column of names.
How the design avoids it
Hidden-content checks on every release copy, flattened output, and a person's final check before it is sent.
Goes wrong
The search tool is given standing access to every mailbox.
How the design avoids it
Access granted per request by the FOI team, time-limited and logged, so it is no wider than a manual search.
Goes wrong
Officers accept suggested exemptions without weighing the public interest, and decisions are overturned at review.
How the design avoids it
Suggestions carry reasons, not conclusions; the public interest balance is always written by the officer; rejected suggestions are reviewed weekly.
Goes wrong
An environmental request is handled under FOI, with the wrong exceptions and time limits.
How the design avoids it
EIR spotting tested on the authority's own past requests, and an officer confirms the regime for every request.
Goes wrong
Nobody planned for the AI's own logs being requested.
How the design avoids it
A retention rule agreed with records management before go-live, and logs kept in a form that can be searched and released.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Keep the suggestion log, the reasons and the officer's decisions in a form you could show the regulator.
Keep the decision rules the assistant draws on in one owned place, so updated guidance can be reflected quickly.
Councils with TMOs should expect questions about who holds housing records, and keep the records map current.
Expect your IT and AI suppliers to face new duties. Update contracts and supplier assurance as the rules are published.
Record which encryption protects the search index and collected records, and keep it easy to change.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
