How keeping humans in the loop improves AI redaction
Businesses today are faced with what seems like an impossible choice: embrace AI and its potential improvements to productivity, but also the potential security risks it brings, or maintain existing human-driven workflows, and potentially be left in the dust by competitors. By incorporating human-in-the-loop into your AI workflows, you can approach sensitive tasks like redaction more efficiently, without putting your organization at risk for regulatory fines or legal issues. In particular, human-in-the-loop is the ideal way to get efficiency gains from AI redaction processes, without risking your customer’s data or your business’s reputation.
If you’re in a regulated industry — government, financial services, insurance, medical, etc. — fully automated redaction is far too risky. Redaction-related decisions require judgment, context, and accountability. The first two are areas that AI often struggles with, and accountability is something that an AI tool can’t provide. Using AI can dramatically speed up the detection of personally identifiable information (PII), but AI isn’t necessarily going to have the precise, nuanced judgment or all the context needed to make the right decision for every situation.
To create a fully compliant workflow, you need to guarantee that nothing is deleted or included without explicit human approval by separating detection from removal and requiring human approval for removal. This is where human-in-the-loop (or HITL) workflows come in.
By incorporating human-in-the-loop into your AI workflow, you get the best of both worlds:
AI recommendations give an efficiency boost and reduce the potential for human error compared to a fully manual review
HITL provides a built-in review workflow, showing who redacted what document, which creates an invaluable paper trail for compliance and audits
Manual redaction is tedious and prone to human error, especially in long and/or unstructured documents. By adding AI into the process, you give reviewers the ability to validate patterns instead of being forced to read every single line or skim large chunks of text. For example, let’s say a document contains multiple names and accident numbers. If the AI tool detects all of the accident numbers but misses one name, the reviewer can immediately see the pattern and fix the missing redaction.
What does human-in-the-loop look like?
In machine learning contexts, HITL means that human oversight has been intentionally incorporated into a workflow at specific checkpoints. It’s the difference between an AI agent “reading” an email, drafting a response, and sending it automatically vs. the agent requiring your approval before sending the email. By being intentional about where and how HITL is incorporated into your AI processes, you can reap the benefits of automation without the risks (and costs) that come with end-to-end automation.
HITL steps can be added to AI workflows in every case (i.e., every final decision needs to be approved by a human) or based on if-then rules. For example, if the confidence score is below 95%, then human approval is needed before the workflow can continue. Or, rather than having a set confidence score, maybe a task falls outside of another predefined threshold, like needing approval to issue a customer refund over a specific limit. In the case of redaction workflows specifically, every final decision should be made by a person, especially if compliance is a concern.
The business case for HITL workflows is simple: you can create a more efficient workflow overall, while minimizing the possibility of expensive or time-consuming errors. This approach also creates an auditable paper trail that shows which human signed off on which redactions and when. A recent report showed that 33% of risk and compliance professionals surveyed viewed regulatory uncertainty or compliance risk as a barrier to adopting AI in their organizations. Adding HITL to your AI redaction workflows is the most effective way to soothe those fears and encourage adoption in your organization.
Do we really need human-in-the-loop?
You might be asking yourself why, if you’re going to go to the trouble of getting buy-in for AI and incorporating it into your organization’s workflows, you wouldn’t just go fully AI. When it comes to sensitive work like redaction, though, HITL isn’t a mediocre compromise — it’s how you get the best of both worlds. Here are three reasons why:
Redaction goes beyond pattern matching. An AI tool might be able to detect PII with a high degree of accuracy, but the decision of whether or not something should be removed requires a high amount of context and nuance. Depending on what document is being redacted and why, a piece of information (a date, a doctor’s name, a medication, etc.) could be harmless in one case and highly sensitive in another case. Evaluating the specific context and nuances of redaction requires a human reviewer to interpret intent, risk, and policy.
Fully automated redaction is unsafe. Depending on what model you’re using, it might miss things or hallucinate details. Our AI redaction tool, AI Smart Redact, uses Named Entity Recognition to identify and categorize important pieces of information. Unlike LLMs, which generate text and can hallucinate, NER is focused on classifying entities and thus has the benefit of not being able to hallucinate. However, it can miss sensitive information or flag non-sensitive information for redaction. For example, “Georgia” could refer to a person, a country, or a state — similar terms that change depending on context are ones that NER is likely to struggle with. Or, if there’s a description that could identify someone (“the head OR nurse”), that could easily be missed by an AI tool. Examples like these illustrate why fully automated redaction can be messy at best and disastrous at worst.
On top of that, document formats vary from industry to industry and case to case. A medical training company has different redaction needs (both in the type of sensitive information being removed and in the formatting of documents that are being redacted) than an insurance company. Even with an insurance company, cleaning up documents related to a specific claim might entail reviewing police reports, medical records, and repair estimates. Expecting the same automated tool to flawlessly redact documents across a range of formats is a recipe for disaster. A single missed piece of information is all it takes to create a breach, and if mistakes are made, saying “the confidence threshold was above 95%” won’t help you avoid the accompanying fines. Regulators require defensible human attribution, and a confidence score — even one of 99% — does not provide that.
At the end of the day, AI should assist, not act autonomously. Document reviewers don’t need an auto-redaction black box. Instead, they need a system that identifies what words/phrases/numbers should likely be redacted and exposes them for easy human review, without ever performing irreversible actions without human approval.
The ideal HITL redaction workflow
The ideal redaction workflow has three distinct stages:
Identify: The AI tool surfaces all potential candidates for redaction without modifying the file, based on parameters defined ahead of time. This part of the process improves coverage, reduces the time spent manually searching for PII, and lowers the risk of human error.
Decide: This is where the HITL comes in, as a person makes the decision to approve, edit, or reject proposed redactions (and add any additional redactions of their own). By separating out the decision-making as its own part of the process, the person reviewing the redactions can focus solely on policy and judgment. The AI tool accelerates detection, and humans remain accountable.
Remove: The redaction is executed deterministically and with an audit-proof record of every part of the process.
In this workflow, HITL is a requirement to maintain the integrity of the redaction process — it’s not just a safety net for your AI tool.
Whatever your redaction workflow is, it needs to stand up to scrutiny. An outside observer must be able to review records that document who signed off on what redactions, on what date, and why they redacted the information they did. The requirement for mandatory audit trails and deterministic workflow states in compliant organizations demonstrates the need for human oversight. On the other hand, irreversibly deleting content as part of a completely automated process violates auditing and regulatory frameworks.
The bottom line is that regulations require someone to be held accountable for specific actions (or lack thereof) and explain what specific part of the process failed. You can’t do either of those things with an AI agent.
After decades of working with customers in heavily regulated industries to perfect their document-processing workflows, we know that enterprise-grade AI redaction should be:
Deterministic: When redacting documents, it’s vital to get the same results from the same inputs, every time. Humans should set the parameters for which PII elements to redact, rather than leaving it up to a generic engine to determine.
Stateful: In highly regulated industries, having access to clear records for compliance purposes and potential audits is crucial.
Review-first: Human review is required before any changes are implemented.
Adding HITL into your AI workflows isn’t a bottleneck. It’s the only way to deploy AI-driven redaction and still maintain full control, stay compliant, and prioritize security. It solves the problem of having auditable records without being bogged down in fully manual processes. By letting AI accelerate the detection process, and having humans involved to review the context, course-correct if needed, and provide accountability, you truly get the best of both worlds.
If you want to learn more about creating secure redaction processes, check out our guide to the hidden layers of PDF redaction…and if you want to start implementing the tips in it, make sure to get on the early access list for AI Smart Redact.