Input data and information sources
The collection contains emails, contracts and documents written by outsiders. Emails and files identify staff, parties and third parties.
E-discovery and technology-assisted review (TAR)
Also known as: E-discovery, technology-assisted review (TAR)
The system ranks large document collections by their likely relevance to an investigation or information request, making review easier.
Understand the use case
What defines this use case?
A UK regulator, a Dutch province and a US department use these systems.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
- System design
- Analysis and processing
- Ability to act
- Provides results for subsequent use
- Fields of use
- regulators, public administration
- Also known as
- predictive coding, technology-assisted review
How it works, step by step
System design and data flows
Input data
An investigation or information request brings together a large collection of emails, files and records.
The collection contains emails, contracts and documents written by outsiders. Emails and files identify staff, parties and third parties.
Processing
Specialists assess a sample, and the model continually learns which documents are likely to be relevant.
The system prepares the document collection for search and comparison and evaluates documents against the investigation question. The results may help prioritise review. A ranking expresses estimated relevance; it replaces neither reading the document nor the professional judgement of its significance.
Results
The system ranks documents by likely relevance and estimates how many relevant documents remain unread.
The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.
Use and impact
The ranking determines what people read, what is disclosed and what supports an investigation.
The model supplies information for subsequent use. Selection, adoption or a professional decision in the following workflow is a separate step and should not automatically be attributed to the model.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
8 review first15 clarify8 baseline threats
- Present
- Depends on your system
- Absent
- Review first
- To clarify
How to use the model
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
Changes from the typical case
None yet. Each change will appear here.
Where most threats arise
- 5 clarify
- 5 clarify
- 3 review first, 1 clarify
- 3 review first
In this system design: 8 to review first, 15 to clarify, 8 baseline threats.
Architecture as a list
External access: Depends on your system
To clarify
Input: Part of every AI system
Review first
To clarify
Baseline for every AI system
Third-party content: Present
AI model: Part of every AI system
To clarify
- Sleepy Agent (Time/Event-Triggered Hidden Instructions)
- Prompt Injection: Direct
- Prompt Injection: Indirect
- Jailbreaks
- Meta Prompt Extraction
Baseline for every AI system
Provider service: Present
To clarify
Document collection: Present
Review first
To clarify
Training and feedback: Present
Review first
Result: Part of every AI system
To clarify
Baseline for every AI system
person: Part of every AI system
Review first
- Overreliance Review priority
Affected person: Depends on your system
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
How it differs from similar use cases
Automated anonymisation and redaction
Only finds and redacts personal information in documents already selected
AI knowledge assistant (enterprise search)
Answers questions from a document collection rather than ranking documents
Data and information
Processing and operating environment
The platform and learning method come from providers such as Relativity or ZyLAB.
Storage and further use
The system makes the collection searchable and finds documents similar to those already judged relevant. For each case, the model learns afresh from reviewers' assessments.
Results and data sharing
On a cloud platform, the provider holds the entire investigation collection.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
From understanding the system to analysing risks
- Define the system boundary
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
- Investigate threats
Relate review candidates to actual data flows: what could happen, and who would be affected?
- Assess risk
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
- Provide evidence of measures
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
Key threats in the application context
- 3 particularly important
- 5 typical
- 15 depending on the system
- 8 additional threats for every AI system
A total of 31 threats from the threat catalogue may be relevant to this use case.
Priority review points
Targeted Poisoning / Label Poisoning
A reviewer accidentally or deliberately marks incriminating documents as irrelevant. The model learns from this and moves similar documents to the bottom, where nobody reads them.
Review ends when the model expects few relevant documents to remain. If that estimate is wrong, important records remain unread and the gap goes unnoticed.
Sensitive Information Disclosure
The collection brings trade secrets and personnel records from many parties onto one platform. Overly broad permissions expose more information to reviewers or third parties than the case requires.
5 further review candidates in the typical design
Other relevant threats
Your own training or operational feedback can introduce manipulated data into training datasets.
Listed because of these characteristics
- Learns from your own data
- Learns in operation without renewed approval
- Uses operational feedback
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of these characteristics
- Learns from your own data
- Uses another provider's model
Targeted queries can recover some personal or protected training data from the model.
Listed because of these characteristics
- Processes personal data
- Processes confidential data
Exfiltration from ML Application
Protected data can leak through tools, network connections, storage or insiders.
Listed because of this characteristic
- Processes confidential data
RAG-Specific Attacks (Document Poisoning)
Content entering the retrievable knowledge collection can influence answers and subsequent steps.
Listed because of this characteristic
- Searches its own document collection
Up to 15 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. One of these is particularly important here and is therefore listed above.
System features and open questions
Each Yes adds further threats to your checklist, up to 15 in total. If you cannot yet answer a question, include its threats in your review.
- Added by this Yes
- Also requires a Yes to another question
How your system is built
- Performs natural language tasks5 threats
- Generates its own text2 threats, plus 1 only in combination with other characteristics
- Processes text, images and speech together2 threats
- One search store for several permission groups1 threat
How you operate the system
- Accepts queries directly through an interface4 threats, plus 1 only in combination with other characteristics
- Accessible over a network3 threats
- Incurs costs with each query1 threat
- Shares computing resources with other customers or applications1 threat
- Used alongside unapproved AI services1 threat
How your system is built
Does the system generate its own text, such as answers, drafts or summaries?
Traditional approaches only rank documents. Newer platforms use a language model to summarise documents or explain their relevance.
If yes, add
Can users give the system natural language tasks that it then performs?
A language model reviewing documents may follow instructions contained within them.
If yes, add
Do documents from several customers, departments or permission groups share one search store?
If several cases' or clients' collections share one platform, search and permissions must keep them separate.
If yes, add
Does the system process several input types together, such as text with images or speech?
If yes, add
How you operate the system
These questions arise for almost every AI system.
Can people or programs query the model directly, for example through an interface?
If yes, add
Is the system accessible over a network or dependent on network services?
If yes, add
Do you pay per query or unit of computing time, so costs increase with use?
If yes, add
Does the system share servers or computing resources with other customers or applications?
If yes, add
Do staff also use AI services for this task that your organisation has not approved?
If yes, add
Controls and implementation
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Review priorityTargeted Poisoning / Label Poisoning3 measures
Review priorityOverreliance3 measures
Review prioritySensitive Information Disclosure3 measures
Training Data Poisoning2 measures
Backdoor ML Model2 measures
Privacy Attacks3 measures
Exfiltration from ML Application3 measures
RAG-Specific Attacks (Document Poisoning)3 measures
Controls for the remaining threats are available on their pages in the threat catalogue.
AI Act provisions
-
Art. 4: AI literacy
For every AI system Applies since 2 February 2025.
-
Annex III no. 6: Law enforcement
Depending on use Review trigger from 2 December 2027.
Applies to every AI system
Art. 4: AI literacy
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Obligations and details for Art. 4: AI literacy
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
May apply in particular uses
Annex III no. 6: Law enforcement
Applies if a law enforcement authority uses the system to assess the reliability of evidence in investigations.
Applies from 2 December 2027.
Obligations and details for Annex III no. 6: Law enforcement
- The general condition is
- Applies if law enforcement authorities or bodies acting for them use the system, for example to assess evidence or people.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Generally does not apply
Annex III no. 8 point a: Administration of justice
Authorities and law firms review documents for proceedings. The system does not help the court itself establish or interpret facts.
Obligations and details for Annex III no. 8 point a: Administration of justice
- The general condition is
- Applies if the system helps courts or dispute resolution bodies establish facts and interpret law.
- Exception
- Purely ancillary tasks such as anonymising judgments or staff communication are excluded under recital 61.
- Who bears the obligations
- Provider, Deployer, Product manufacturer
Detailed obligations
Classify your system with the quick checker All obligations in the obligations compass
Cross-cutting threats
Review these threats for every AI system, whatever its purpose.
Atypical system features
View 14 further questions
If any of these features does apply to your system, add the listed threats.
Does the system generate or edit images, sounds, voices or videos?
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
If yes, add
Does the system use a knowledge graph storing concepts and their relationships?
If yes, add
Does the system remember content from earlier conversations or tasks and reuse it later?
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Does the system directly move or control something physical, such as motors, valves, vehicles or temperatures?
If yes, add
Can people outside your organisation use the system, including without login?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Does the system execute programs, scripts or commands itself?
If yes, add
Is the system intended to maximise a specified metric, such as revenue, utilisation or clicks?
If yes, add
Sources
- Register or case collection
UK Algorithmic Transparency Record, Care Quality Commission: Relativity Active Learning
A machine learning model (support vector machine) ranks documents by relevance to an investigation.
- Register or case collection
Dutch Algorithm Register, Ondersteuning Openbaarmakingsverzoeken, Provincie Noord-Holland
The province indexes, analyses and redacts documents using ZyLAB.
- Register or case collection
US Federal AI Use Case Inventory 2024, raw data
The US Department of Homeland Security (DHS) lists RelativityOne in its AI use case inventory.
Related use cases
Also in the field of Documents and casework
- Intelligent document processing (IDP)The system reads correspondence, invoices and forms, routes them to the responsible team and transfers their data into business systems.
- Automated anonymisation and redactionThe system finds names, addresses and other personal information in documents and suggests redactions for a person to approve.
- Text analytics for feedback and consultation responsesThe system summarises large volumes of free-text survey, complaint or consultation responses, identifies themes and classifies each response.
Often used together with
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured