Detection is a machine task. Deciding what must be withheld is a professional one — and the two failures look completely different when they go wrong.
Key takeaways
AI can redact client documents in the sense that matters most operationally: it can find candidate content at scale and mark it consistently across thousands of pages, which no human team does reliably. Microsoft’s documentation for PII detection in Azure Language describes exactly this — identify, classify and redact sensitive data across text, conversations and documents, returning structured output with entity categories, confidence scores and redacted results according to your configuration.
What it cannot do is decide policy. Whether a name is withheld, whether a paragraph is privileged, whether a redaction is so extensive that the document should not be produced at all — those are decisions with professional consequences, made by a person who is answerable for them.
Privacy redaction removes personal information about identifiable individuals before a document goes to someone who has no business seeing it. The test is about the individual and the purpose. Our sister firm’s note on what counts as personal information is the practical starting point, and the obligation follows the information: under clause 4.1.3 of Schedule 1 to PIPEDA an organisation remains responsible for personal information transferred to a third party for processing, which includes the redaction service itself.
Privilege redaction withholds content because it is legally protected. The test is about the communication, not the person. The distinction is developed in this article on privilege claims on discovery in Ontario and in the companion note on privileged documents in Ontario litigation. Running one process for both is how a firm ends up either disclosing advice or blacking out something it then has to explain.
A black rectangle drawn over text in a PDF is an annotation. The characters are still in the file, selectable, searchable, and recoverable by anyone who copies the page into a text editor. Real redaction removes the underlying content and produces a new file. Any workflow you build must end with two steps: apply the redactions destructively, then verify by searching the output for a sample of the terms you removed.
Verification is not optional and it is cheap. Take five names, five account numbers and one distinctive phrase from the source, search the redacted output for each, and record the result on the file. A firm that does this once a week catches a misconfigured pipeline before a client does.
Detection is only as useful as the classification behind it. Microsoft’s explanation of sensitive information types is a good model for how these systems work: named patterns, evidence and confidence, combined into rules rather than one global switch. Write your firm’s policy the same way — a table of information categories, and for each the default treatment when a document goes to a named class of recipient.
The recipient axis is what most policies miss. The same medical record may be fully disclosed to the client, partially redacted to an opposing party, and heavily redacted in a public filing. One document, three outputs, one policy table. The Privacy Commissioner’s principles for responsible, trustworthy and privacy-protective generative AI are worth reading alongside it, because they apply to your firm as a user of the technology.
For lawyers, rule 3.3-1 of the BC Code of Professional Conduct requires holding in strict confidence at all times all information concerning the business and affairs of a client acquired in the course of the professional relationship. Uploading an unredacted brief to a third-party service to have it redacted is a disclosure of that information to that service. Whether it is a permissible one depends on your arrangements with the vendor and on your own jurisdiction’s rules — compare provisions on the Federation of Law Societies’ interactive Model Code and confirm with your law society.
For any Canadian firm, the same reasoning applies to privacy: whether you need a privacy policy that covers this processing at all is answered in this note on privacy policy requirements, and if a redaction pipeline ever leaks, the breach notification obligations are the thing you will be measured against.
A firm producing a document set for an opposing party runs three passes. Pass one, automated detection of names, addresses, financial identifiers and health identifiers across the whole set, producing a marked-up copy and a per-document report. Pass two, a lawyer reviews every document flagged as potentially privileged — not the redactions, the privilege call — and this pass is never automated. Pass three, destructive application, then verification searches on a random sample of twenty documents.
The proportion of pages needing no human edit in pass one is the number that tells you whether the configuration is working, and it is specific to your document types, so measure it rather than assuming it. The number that tells you whether the process is safe is different: it is the count of verification failures, and the only acceptable value is zero.
Can we redact a scanned document?
Only after OCR, and then with more care: the redaction must be applied to the image as well as any text layer, or the words remain visible in the picture.
What about client access requests?
Different question, same tools. Responding to a request for someone’s own personal information has its own rules — see responding to personal information access requests — and third-party information in the same file usually has to come out.
Is it safe to use a general chatbot for this?
Treat pasting client material into a consumer tool as disclosure to that provider. If your firm has an AI policy, this is the clause it exists for.
A 30-minute call is enough to tell you whether AI pays for itself here.
