Unlocking the Future of Records Management with AI

Duration: 1:00:15 · Recorded: 2025-05-20

Speakers: Jerry Manter, Marketing and Communications Specialist, Zasio (host); Jennifer Chadband, CRM, IGP, CIPP/E, Licensed Attorney, Senior Consultant / Consulting Co-Manager, Zasio; Rick Surber, CRM, IGP, Licensed Attorney, Senior Consultant / Consulting Co-Manager, Zasio

Lightly edited machine transcript. Slides are summarized where they carry information not spoken aloud.

Jerry Manter: All right. Well, good morning, everyone, and welcome to another edition of Virtual Coffee with Consulting. My name is Jerry Manter, marketing and communications specialist here at Zasio. Leading this RIM and AI discussion today are Jennifer Chadband and Rick Surber. They're senior consultants and co-managers of our consulting department. If you have any questions, be sure to submit them via the questions panel and we will make sure to follow up with you via email. After the presentation, we invite you to take our survey and let us know how we did and if there are any topics you would like us to consider for a future session. And finally, I will be following up with everyone via email to share a link to the recording, as well as the slide deck.

[Slide: Meet Our Presenters: Jennifer Chadband, CRM, IGP, CIPP/E, Licensed Attorney, Senior Consultant / Consulting Co-Manager; Rick Surber, CRM, IGP, Licensed Attorney, Senior Consultant / Consulting Co-Manager.]

And that is all for me. I'll now hand things over to Jen, who will get things started.

Jennifer Chadband: Great. Thanks, Jerry, for that introduction, and welcome, everybody, to Virtual Coffee today. Thank you so much for joining us. I know we were really excited to see the guest list. We've got a lot of attendees here today, including some new names. So we're always really excited. For anybody that's joined us before, I think you kind of know our spiel.

[Slide: Today's agenda. Discussion: AI's rapidly evolving role in RIM; how programs are adapting; explore AI and use cases in RIM/IG; understand AI governance; benefits and risks; next steps. Questions.]

But anybody that's new, just so you know, make sure that you've got your favorite beverage of choice, whatever that might look like with you. Coffee, tea, Diet Coke, whatever it might be. It's a little early for whiskey, though, I'll say that. So hopefully you have something warm for your drink this morning. So anyways, I think I just wanted to, first of all, here's kind of our agenda today. We try to keep this a bit conversational, but it's also, I think, a chance for us to showcase and share a lot of the information that we're encountering. AI, of course, is always really exciting. It's a hot topic. And just when you kind of think that things may be settled, there's always something new popping up.

So it's really exciting to present on it. And I think for today's discussion, here's some of our points that we're going to kind of talk through, and I'll let you read through them. But we wanted to really touch on this big picture, and from top to bottom, from governance all the way down to the technology, kind of what's happening, what are we seeing? And how can you take some of this information away and see if there's something there for your program or what you're doing? So it's definitely kind of touching on a lot of different things. We try not to get too into the weeds for this discussion today, but it's really exciting. So I think that it is just to start with really big picture.

It's a super fascinating time to be in this industry right now, because AI undoubtedly is transforming the management of our records information practices across industries, and RIM and IG, we're really at the heart of all of this. So if you think about it, we are oftentimes on the front lines of these information revolutions, I guess you would call it. I like to think of it as kind of like first responders. In a lot of ways, we're still trying to catch up with this digital revolution, which was this huge explosion of information, allowing huge amounts of storage, including, now we get into the cloud and it seems very accessible, more and more information. And now we're kind of going into this age of AI, which is kind of pushing us more towards both creation of more information and also pushing us to want to keep the information. It's just really amplifying everything. So we're finding all these ways, organizations, it's an exciting time, they're finding ways to use information. They're not just thinking of the now, they're also thinking of the future, how these capabilities and the technology is evolving, how it could bring even more value to the information that we're typically keeping and creating. So this mentality of keeping information just in case is really just kind of increasing all the time. The value of our information is more apparent than ever. At the same time, the risks are more apparent than ever. The stakes are higher than they've ever been.

So in our roles, we really kind of have to find the best ways to kind of manage this information in a way that allows our organizations to extract the maximum amount of value while minimizing that risk. At the same time, all this is happening. It's revolutionizing how we do our jobs in the RIM industry, implications for compliance and governance and technology, how AI is changing RIM on many different fronts. And these are kind of all the things that we'll be getting a little bit more into the weeds on, and what that looks like, how the revolution, the new information revolution, is happening. So kind of with that big-picture introduction, I want to dig into some fun facts. So I kind of thought about these facts, and there's no, I'd say, dearth or lack of information or stats that's coming out. Certainly people are really trying to find ways to measure how is AI beneficial? What are some of these roadblocks or whatnot? So thinking about this chicken-and-egg scenario, as it were, we're confronted with a scenario that 44% of organizations lack basic information management measures. Hopefully, we're not all in that camp. I think that for the most part, we have some sort of information management measures within the organizations, various stages of maturity. But kind of going to our next stat, this is kind of the conundrum we have here.

[Slide: The Chicken, The Egg & The Algorithm: 44% of organizations lack basic information management measures; mature information management increases AI success by 1.5x. Source: #shifthappens Research, Explore the AI and Information Management Report 2024, https://www.avepoint.com/shifthappens/reports/artificial-intelligence-and-information-management-report-2024]

Mature information management increases AI success by one and a half times. So while we're in this kind of scramble to adopt and implement AI and take advantage of it and remain competitive within our industries, we're also confronted with the reality that if your information house is not in order, you're not going to be able to really ramp up as quickly as you'd like. So here's the next statistic that we'll go to. 52% of organizations struggle with data quality during AI implementation. So it's really kind of showing this paradox, and RIM is at the center of it. So it really is, I think, reinforcing what an important role RIM plays and how much value we can bring to these sorts of initiatives and ensuring that they can be successful. So we're really kind of at the center of all this. And some other stats that came from this, and these are just a little bit off the cuff here, but as far as reporting the tangible benefits, those that were able to have that increased success were showing improved efficiency by 74% and better decision-making by 67%. So I think improved efficiency, you'll notice better decision-making, these are kind of some of the centralized themes that we'll be talking about here throughout all these different initiatives from top to bottom, changes within RIM. Really, the point is to drive a lot of these business benefits as well. So it's the classic chicken, egg and algorithm scenario. AI needs clean, well-managed data to succeed. And so many organizations are only beginning to prioritize RIM a little bit, especially in certain areas, and really getting down to the nitty-gritty of how your data is being maintained. They're a little bit late to the game, a little bit behind the ball when it comes to launching these initiatives. And so with that, why don't we, I think we'll just talk a little bit. People are definitely, and I'll hand this over to Rick, but just to kind of help introduce it, people are familiar with some of the basics of the different technologies. But I think Rick wants to highlight, and we want to talk a little bit about, these ones that are most important to RIM, our profession, and kind of like, what are we seeing as far as the different types of AI that are actually most helpful in kind of driving some of the changes that we're seeing in RIM? And I'll hand that over to you, Rick.

Rick Surber: Yeah, thanks, Jen. So we're going to dig just a little deeper into how some of these technologies can be helpful to us as RIM and IG professionals. We could probably do full webinars on each of these and might actually devote future Virtual Coffees to digging into some of them. But for now, we're going to introduce at a high level and we're going to kind of set a foundation for the rest of our conversation today. The first few are focused on helping with records appraisal. So they're going to be analyzing, classifying, making decisions based on existing data, existing records. That means that they mostly fall into the discriminative discipline of AI as opposed to generative. But we'll talk a little bit about generative as well.

Let's start with natural language processing and machine learning, which are both really useful tools for records appraisal and categorization. Natural language processing automates the understanding and classification of text-based content. With this, we can tag, extract metadata, even identify sensitive data. Machine learning, on the other hand, recognizes patterns in data and processes, learns from and improves them without having to be programmed for every piece of data. So this can be trained in a supervised way, where you teach the correct inputs and outputs and then AI applies it to new data, or an unsupervised way, where AI looks for patterns, groupings or structures in the data and on its own classifies. So RIM is using both of these to improve document classification, retention scheduling potentially, extending retention to documents potentially, or at least making that possible, and then compliance risk detection over time. Next is intelligent document processing. This is AI-driven data extraction and document classification from diverse formats. So think of a picture of a document in a foreign language. It's unreadable on the computer. It's also unreadable if it's not in your language. So first, we need to use optical character recognition, or OCR, to be able to read it on the computer, and then we can use natural language processing to assist with translating and classifying it based on its content. So that's kind of a cool way that it pulls all of the things we've talked about so far. And then, kind of wrapping up these discriminative tools, we can add another layer with robotic process automation. This automates some repetitive administrative records management tasks and has the ability to join AI processes at scale. So for example, if we were to build on what we discussed about OCRing a foreign-language document, robotic process automation could be integrated to scan a local network, maybe, for all PDF images and then implement this process for dozens or hundreds of previously uncategorized records. So combining all of these methods could involve an extensive unstructured file network drive and add the necessary metadata and classification to understand what's there and to be informed about how to apply retention to it. So, really cool stuff. This last one is the celebrity of the AI processes, and I know you've heard of it: conversational AI, or AI assistants. These are the systems that leverage artificial intelligence, especially large language models, or LLMs, to understand and generate human-like responses to natural language input. So we're talking about ChatGPT, Copilot, chatbots. And then many of you may have some open-source and homegrown developments that are working off of this same technology. But this is content generation, and it shifts these, from the majority of what we discussed, from discriminative to AI generative.

And they're really helpful. I mean, many of them are even kind of replacing typical old internet Google searches and just assisting with our everyday processes. That doesn't mean that they don't need some safeguards and that they don't need some caution applied, which we'll talk about as we get a little farther along. So with that, I think I'll pass it back over to Jen to talk about how AI is being used in RIM.

Jennifer Chadband: Yeah. And I think, thanks, Rick. Kind of thinking about those different types of AI, it seemed like you almost had them listed in descending order as far as what's most kind of prominent. And I think that really checks as far as what we're seeing: NLP, machine learning kind of being most common, intelligent document processing. Some of these technologies have been in play for the past few years. And of course, NLP we've been probably using in various capacities over the years, actually.

So some of this has been there, but crawlers have been using this technology now for years. [Rick Surber: Absolutely. Absolutely.] But as far as kind of how this is evolving and how it's most helpful, and just some more kind of concrete ideas here. So expanding a bit: auto-classification, metadata tagging. So this is really that process where it's kind of assigning categories based on the content or the context, structure, and can be without human input. However, oftentimes the models do need to be trained. So there's actually a range of customizability. So there's kind of like out-of-the-box solutions or models that are kind of like ready to use, or others that require customization and have to be trained on your organization's information. And just some tangible, I guess, ideas here: like Viva, the software solution provides like auto-classification capabilities directly within it. Microsoft Purview is using AI and this type of classification to classify like sensitive information, identify like confidential, proprietary, different types of information within the system for increased security and various purposes. So just some ideas.

Those are kind of things that we're seeing and becoming more common. With regard to document capture and the metadata extraction, really what that does is taking out the key information. So that might be commonly like dates, names, invoice numbers, and it's taking that from scanned documents for indexing and compliance. And so it's kind of combining that OCR with the AI models to read and interpret. And that's for both structured and unstructured documents, which is immensely helpful as far as getting everything organized. And this is a big kind of ROT one, this next one, the duplicate detection, remediation, a really great kind of technology that can be used for ROT cleanup: redundant, obsolete, trivial. So identifying redundant files to really reduce storage costs and declutter. And what it's doing is identifying and flagging duplicates or really kind of near-duplicate documents to kind of go through all of that. It tends to be kind of a massive cleanup effort. This is the low-hanging fruit. Depending on the size of your organization, the amount of records and information data that you're dealing with, this might be very, very helpful for those types of initiatives. So that's quite common. Finally—

Rick Surber: Jen, I was looking at the technology they're using for this duplicate detection, and it's pretty incredible. Like, you would think it would be file names and sizes or something like that. But I mean, they're even using deep learning to convert files into vector embeddings to compare meaning or content similarity. It's crazy, the way that they're using AI to compare documents in ways that you wouldn't anticipate happening.

Jennifer Chadband: Yeah, that's actually a lot more sophisticated than I was thinking the capabilities look like. So that's really, that's still really cool. That's amazing. A big one as well, thanks for sharing that, Rick. Another big one is e-discovery support. So I think that this has been really in the works for a while and very, very valuable. But AI can assist in identifying relevant documents for various legal matters. And this is done through semantic searches, predictive coding, also concept clustering, which I thought was really interesting. So concept clustering is kind of more of like an unsupervised learning AI technique. So it's used to group documents or data points based on shared themes or ideas rather than just kind of keywords or exact matches. Keywords and exact matches is something that's more common with like predictive coding, which requires more of an assisted kind of learning model. But it's immensely helpful when you're dealing with huge volumes of information, data, structured and unstructured, going through that content analysis and being able to facilitate an easier kind of discovery response kind of search. So this comes up a lot. Always part of the questions when we're working on program strategies and email management strategies. Sometimes it's in the context that we're already under a legal hold for certain things. How can we start being able to make sure that we're identifying everything that is subject to that legal hold while maintaining our schedule implementation and continuing to manage disposition in due course? So very, very common, comes up a lot. So yeah, there's a lot of good stuff. And this is just kind of the tip of the iceberg to what we're touching on. We had to scale this back a lot without getting too into the weeds, because the first time that we kind of went through a presentation, it was like, wow, there's so much here. And it's fascinating. But yeah, these are just to give you a good idea, and some of the more common.

So why don't I kind of shift over here, and we'll talk a little bit more of some more concrete, I guess, some use cases. And these are use cases. And I guess just to highlight, later in the presentation, we want to give you some like real-world examples and kind of what we call AI goals for RIM. But we'll start here, because I think that these are really helpful to kind of further understand what this is really looking like and how it's playing out. So I'll hand that over to you, Rick.

Rick Surber: Yeah, we'll get out of the theory as soon as we lay a little foundation, we promise. So let's switch hats and discuss some IG use cases at a high level now. So AI-assisted compliance monitoring and policy management. We're going to talk a little bit about identification of sensitive information. We talked about it already, we'll talk about it more. But there's also the ability to kind of monitor data usage patterns and flag unauthorized access or risky behaviors. So this is kind of straddling the IG/infosec areas. AI can flag actions that go against internal privacy policies, such as pulling customer data into unauthorized places. It can even use fields within documents to say, "Hey, that's not supposed to be here," like Social Security numbers, that kind of a thing, depending on how granular the processes extend. Another thing it can do is review and recommend updates to information management policies. Now, that should be taken with a grain of salt, because in my experience, even experimenting with the chatbots and asking them specific questions about regulations, we're getting a lot of incorrect responses, some hallucinations, some outdated stuff. And so it needs to be something that's carefully managed, and accuracy issues need to be taken into account. But one thing that it's really helpful with is it does reliably identify differences in documents, which, if you're comparing policy versions, trying to understand how things have changed, or if you're doing legal research and you're working on a state like Colorado that's got really long laws, and you know that it's changed but you can't figure out what, these are some of the tools that really help us identify what has changed and make it easier for us to incorporate those changes.

Jennifer Chadband: I'll jump in just quick, Rick. I was just going to say, when you're talking about that, and having been really kind of in the details, this is just very kind of laborious, very detailed type of work. So being able to rely on tools that can cut down on the amount of time and really kind of free up your time to focus on those more, I guess, higher-level and strategy-type work, I think for a lot of people will feel like a relief, being able to actually implement and have those tools at their fingertips. One of the stats I had run across in all of it that I found, it said that AI-powered policy compliance tools can reduce time spent on data audits by up to 60%. And so I think that that might be music to a lot of people's ears, but just to kind of highlight again, going to that theme of efficiency, how much it really helps us just do our jobs day to day.

Rick Surber: Yeah, that's a great stat. Thanks, Jen. Next, anomaly detection. It can flag unusual or unauthorized data access to prevent potential breaches. So it builds a little on the privacy compliance monitoring here, but it does this by monitoring access logs, system activities, maybe even user behavior, and then it can flag or notify for outliers, such as unusual access times, unauthorized access to data, high-volume data transfers, that type of thing. Risk scoring for unstructured data. This is interesting. When we talked earlier about using all of the AI features to kind of scan networks, that was kind of assuming that you just let it loose on everything. But if you've got certain areas that you feel might be riskier than others, it might make sense to use this kind of risk scoring to assess repositories for potential regulatory and operational risks. And then you can focus on specific areas that have sensitive data or regulatory, confidential, proprietary kind of considerations. And so, pretty useful thing to try to kind of plan how you're going to use AI and start this whole process off. And then AI can just generally enhance searchability and retrievability. We've talked about that optical character recognition already. Pretty powerful to be able to not just search things that are readable, but also extend to things that aren't readable. It's also powerful to have kind of this smart semantic search capability. It's pretty powerful over those old keyword searches that often missed a lot of things based on not using the right word or synonyms or different phrasings. So these things are really enhancing retrievability.

100%. And so, governance models in AI: AI governance and representative working groups within IG committees. This is something that we're recommending and that we're seeing a lot of clients do. You've got to have an IG or an AI representative within those IG committees. And it might even be worth exploring having a separate IG committee as a cross-functional oversight body to do the same thing that our IG committees do: review projects, manage risk throughout kind of all of the functions and all of the different stakeholders. But even if you have a separate committee, AI should be part of the IG committee, and probably indefinitely vice versa, if you have two different committees. [Jennifer Chadband: Mhm.]

But this is all kind of speaking to cross-functional stakeholder collaboration. Like with IG, we'll want to involve all of the different areas of the organization that are using this in different ways: legal, IT, compliance, privacy. Everyone is using AI and needs to be involved in this conversation. It's very similar to the IG kind of revolution that came, and needs to be all-inclusive like that.

Jennifer Chadband: Yeah, I was going to say, Rick, don't you feel like, with thinking about like the AI governance and who's involved, it's almost to me like I think that the businesses kind of take a front seat in a way? I mean, they really do play a more prominent role, I think, than we would typically think about, because they're really the ones that are knowledgeable, I think, about the impacts, because risk, yeah, risk being kind of one of the central things that we're thinking about with regard to AI decisions. But they're the ones who can have knowledge and help assess what would the impact be on customers, on operations, on compliance. And they are the ones that are kind of on the front and can kind of be able to help ensure that the systems are transparent, fair, because they are the ones that have the knowledge, the most intimate knowledge of their records and information. And with this elevated risk and whatnot, I feel like, I guess, yeah, in my mind, they just really play a more prominent role than what we might typically think of.

Rick Surber: Absolutely. The uses are so diverse of AI, and that's the thing that is a major consideration in this. And so, we've talked now for about 20 minutes on the different uses for RIM and IG, but each of these different branches are using it in different ways and probably would have similar lists of different ways that they're using AI that all need to be understood, and processes need to be developed to manage that and govern it. So, like, a good way to start, that's a great segue, is these risk assessments for AI initiatives. Just a structured approach to identifying, evaluating, and mitigating potential risk associated with the development and deployment of AI systems. It typically considers factors like data integrity, model bias, transparency, accountability, all of these different things that we'll talk about a little bit more. But this type of framework really helps organizations balance innovation with the ethical, legal, and operational safeguards. And so I think we'll get into some of this regulatory compliance, the challenges, those types of things next, and I'll turn it over to you, Jen, to talk a little bit about the regulatory compliance side of things.

Jennifer Chadband: Great. Yeah, thanks, Rick. I think that this AI and regulatory compliance aspect, I think, is really fascinating.

[Slide: AI and Regulatory Compliance. 69 countries have proposed over 1000 AI-related laws and other initiatives: EU AI Act; China, multilayered framework; Canada, Artificial Intelligence and Data Act (AIDA); Japan, voluntary guidelines; U.S. EOs (some state laws). Privacy laws intertwined with AI: data-centric; overlapping regulatory goals (transparency, fairness/non-bias, accountability); work together (EU AI automated systems and GDPR Article 2s [as shown]; California CCPA and Colorado AI automated profiling opt-outs). Source: AI Regulations around the World - 2025.]

I presented, or we presented, with Anita Paul. She was the head of Roche Pharmaceuticals' records and information program for a long time. And at the time, I guess it's almost two years ago that that presentation was, but we talked about what are the emerging laws, and the EU Act, I think, had just barely passed or it was about ready to pass at that time. But I was really surprised to kind of do an update on that and see that 69 countries now have proposed over 1,000 AI-related laws and other initiatives. So, wow, like, what a whirlwind. It's kind of crazy. The EU AI Act has really kind of been at the forefront, I guess. And just to talk a little bit about these, because I think it's so interesting, the different approaches and ways that countries are kind of looking at AI, and that really also just plays into your thinking about, especially multinational companies, what do our policies look like? How do they really cater to all these different laws across the country? What do we need to be mindful of? And the EU Act is really one that's kind of, it's comprehensive and binding. So it's really the world's first major national, or, I should say, major law regulating AI. It regulates specifically, though, across all of the member states of the European Union. We'll see kind of a reoccurring theme: it has this risk-based framework. So AI systems are categorized based on different risks, even having like an unacceptable risk all the way down to minimal. And so, of course, there's kind of stricter rules for higher- risk types of AI applications. So it's focusing on protecting fundamental rights. It's ensuring conformity and how AI systems are assessed, ensuring transparency and all these different things. So that's kind of one approach, and I skipped down a little bit. Canada, the AIDA, is a little bit similar to that, focusing on that risk-based framework. So, focus on high-impact AI systems with risk mitigation, transparency and accountability as well. And China is very interesting, I think. They've actually been really driving AI regulations for years. So I would say, in a way, they're a little bit ahead of the curve, although it's a bit different, I think, in their approach. So there's a strong emphasis on state control for those ethics and alignment with national priorities, one of the major things being like industry-focused with regard to driving innovation in manufacturing for purposes of national interest. And so a lot of kind of rapid policy updates, but it's kind of spread across different sectors and regional areas. Japan's an interesting one because they have voluntary guidelines. It's non-binding. It's principle-based. It's based on ethics and kind of voluntary compliance, and ethical AI development as like a main goal for following those guidelines. And so that's kind of one of the models. And the U.S. is also a very interesting case. The U.S. always kind of looks like a patchwork.

It kind of makes me think of how the privacy laws are unfolding across the U.S., very similar kind of scenario with AI. We had an executive order under the Biden administration. That was 2023. The idea in that order, providing some guidelines to promote safe, secure AI development and federal agency coordination in promoting that. And that was just recently kind of reversed under the new administration, and the idea being to remove barriers to innovation, promote AI leadership, free from ideological bias. And then we have the patchwork. So we've got some of the state laws coming in, California and Illinois kind of leading some of that. And Colorado also has their AI law. So really interesting to see how that's all unfolding. And you can't help but see how these are really intertwined and have a lot in common with the AI laws.

As I mentioned, they're all data-centric. They're focused on information, overlapping goals to promote transparency, fairness, non-bias, accountability. And oftentimes they kind of work together: the EU AI automated systems and GDPR, for example, Article 22, which talks about automated profiling, using personal information, which goes along, and it's based on a type of AI technology. And same thing, California CCPA, Colorado AI profiling opt-out. So kind of focused on those higher, what would be considered higher-risk AI uses that utilize personal information. You really get to see how there's that intersection there and quite a bit in common in how these laws are unfolding. So, could go on for a long time about this. Had to cut some of the jurisdictions out because there's a lot of interesting things going on. But again, these are just really important things to kind of be thinking of and aware of, because our policies ultimately draw from this. It informs us of what are the risks that our organizations need to be aware of, and what do we need to kind of be pulling into our governance and our policies, and the risks that we need to be addressing within our organization. So just a quick rundown on the status of things in AI laws.

[Slide: Risks & Challenges in AI RIM/IG: data privacy, bias, and ethical concerns; inaccurate or proprietary sources; lack of explainability ("black box" models); operational and cultural resistance. Graphic: AI bias iceberg (visible: computational biases; invisible: human biases, systemic biases). Source: AI Search Has A Citation Problem - Columbia Journalism Review.]

Rick Surber: Yeah, good stuff, Jen. We're going to talk policies next, but first let's talk risks and challenges. There's this ever-present data privacy issue that Jen just talked. They're very related. They're kind of siblings, privacy and AI, for a lot of things. But there's also some other concerns, like bias and some ethical things. And I really do think these all go back to strong governance and foundations, such as transparency, clear expectations, adherence to the privacy, the laws, the ethical standards, the AI laws. It's all about building AI risk management into existing governance structures. So the bias: it could be poor training data. It could be unfair or discriminatory outcomes. There are a lot of things that are causing this.

And mitigating this bias requires carefully curating the data, auditing the algorithms, and using inclusive design practices throughout the AI life cycle. Inaccurate or proprietary sources, I think it speaks for itself. The law's developing here, but good area to be cautious about, and to avoid those intellectual property issues and the inaccuracies, too. The hallucinations, or the using bad data thing, is real. It seems like it might be getting a little better, but it's still something that we're always going to have to guard against and have processes to account for. Lack of explainability: this kind of black box model thing is an interesting concept that I didn't really know about until I started researching this. It occurs when complex models like these deep neural networks make decisions that are difficult for us to understand or trace. And this can undermine trust. It can hinder accountability. And it can get in the way of regulatory compliance, especially if it's used in some of these high-stakes areas like health care, finance, these things.

So it's really about enhancing model transparency through explainable AI technologies. Use AI systems that are designed to produce interpretable outcomes. Regularly test your AI systems for accuracy, bias and policy adherence. This operational and cultural resistance is interesting to me as well, because I think I was probably one of those that was a little bit late to the game with AI, just because I was a little wary of it, honestly. And I think it's natural to fear these things, to distrust these things, or to worry about it taking jobs potentially.

But I think it's really, in jumping on it and getting into it and using it, it's amazing how efficient it makes searches and source identification and just like research, initial research trials. So it's something that we need to evolve with, but it's necessary to evolve with the AI while preserving integrity. And I think that a lot of that just really boils down to education and change management: train employees on AI, workshop how it should be used, how it shouldn't be used, and build kind of transparent communication around it, so that you're building trust in using it and you're using it the right way.

Jennifer Chadband: Yeah, I think that this is kind of an interesting thing to think about, allowing AI to be our friend and our facilitator and all these different things, while being rightfully cautious, and how do we use it. And I know a lot of companies, and you're going to kind of talk about this, where there's enterprise-wide policies, but thinking about locally and how people are using AI, I saw that, for example, there was some talk about what a local policy might look like in HR and how you should or should not be using AI, for example. Be really careful of relying on AI, or leaning on Copilot to formulate all of your interview questions, for example. You have to be very wary about the different types of bias and kind of some of the risks that come along with that when you're really not being thoughtful about how that information is being sourced, any inherent biases or discriminatory kind of leanings that might come across. So it's really still an area, a gray area, that we're navigating here.

Rick Surber: Mhm. Yeah, I just saw a news story about attorneys using AI to write briefs and it just having all sorts of inaccuracies and hallucinations. And this has been happening for years now, but I think it really highlights the caution that needs to be taken and that is sometimes overlooked.

Jennifer Chadband: Well, I mean, all of the different chatbots that you might use, I mean, they literally all say this is not legally valid. You still have to take everything away. You cannot rely on it for any sort of legal purposes, and people are still learning that lesson the hard way, it sounds like.

Rick Surber: Yeah. Yeah. It doesn't produce its answers in a way that, or it produces its answers in a way that seems very convincing, and so, but a lot of the time [inaudible].

Jennifer Chadband: Yeah, and the sources. And I think it was just a couple months ago that it just said 60% of the news sources that were cited in responses were inaccurate. And that has been, you really do have to track down every source before you really rely on that information. So it's a slippery slope. It's something to be very careful with still. Sometimes you spin your wheels, you're like, okay, it says this, this source isn't even in any way related to this. Oh, it's another one of these AI—

Rick Surber: True. So, I mean, we're talking already about kind of these ethical principles. Many organizations will have standalone policies. Many groups within organizations will have potentially procedures and things like that, because each group, again, is going to be using AI differently. I think that RIM and IG should, within their policy, at least have some kind of an acknowledgement of AI or a reference or something like that, kind of the way that we reference our email policies if those are standalone. So the way that these are all being organized is different for everyone, but they need to cover all of the basic things, like the organization-wide kind of ethical concerns and goals and high-level guidance on the way that AI should be used.

The data protection and privacy mandates. So, I mean, this is where we get into a lot of risk about secondary processing and not having permission or consent. It just blatantly gets into kind of running afoul of those privacy laws. And so, need to be really careful here and make sure that we've got policies that address these things. And then the model documentation standards. This kind of goes to the transparency thing we talked about: understanding how the models are built, how they're trained, the performance metrics that are used, so that we can have a transparent way of understanding and not have to deal with that kind of black box syndrome that we already talked about. Human oversight: it should be mandatory that there are ways to audit the results of what AI is producing. And it should be happening pretty continuously and worked into processes based on kind of the risk, what AI is doing, the types of information that it's producing, the types of potentially records that it's producing, or decisions that it's making. So it's going to be different how that oversight works, depending on the content of what's being created and the risk there.

And then here's our favorite one, as records managers: what are the retention schedule implications here? We definitely need to be keeping track of the AI laws and kind of understanding the way that they're impacting our retention schedule, in the same way that we have to do that with privacy. We're developing kind of an AI framework for these regulations to kind of categorize them, understand what impact they have on retention schedules, and make it easy to find them and apply them, kind of the same way that we've done with privacy in our Versatile software. But then there's this whole question about what's a record, you know? And I think, like everything in RIM, it's really going to depend on the context and the content. And so what is it? What's the process surrounding AI use? How does it relate back to the records retention schedule? How does it impact the way that records are created? Is it creating records?

And then are some of these things, like prompts or the history of the prompts, are those going to be records? These are all really good questions. And I think it all really boils down to the same logic that we're using for email, which is, for casual interactions, or for just maybe general searches for information, these are likely going to fall in the transitory bucket and should be kind of more scheduled towards active use. But if these are going to be used as part of a workflow, or as a way to show compliance, or something like that, they need— [Jennifer Chadband: Or policy development, like—] Yeah, exactly. Yeah, they need to be scheduled with the category that they relate to. And some clients are creating categories for it, depending on how they're using it, and their industry, and the way that they're regulated.

But that's not a universal thing that's happening. Many clients are just kind of filtering them into the existing categories that they relate to, and scheduling them based on content.

Jennifer Chadband: Yeah, I think I saw, just kind of looking at what's kind of trending and what we're hearing from our clients, I noticed that University of Washington's Records Management Services mentions that a prompt is considered a record if it's entered into a generative AI platform. It's considered a record like transitory, just like anything potentially transitory you entered into like an email, or something along those lines. But if it requires longer term, like because it relates to a policy decision or something more substantive, then it goes to the retention schedule; it falls under that content. And this is kind of what we're seeing and what we're recommending as well. I think a lot of our clients are going to that: what is the default? If we have an auto-disposition retention period for email, that's what we're going to be applying internally within our AI system. If we're using like a business license for Copilot, for example, there's disposition capabilities, so they're setting it similarly. But if it is a record, then it needs to be extracted and retained consistent with the schedule and the type of content that it relates to. So, really interesting, we're seeing three months up to a year just for that auto-disposition period, and consistent with whatever the practice is for email. So, still evolving. [Speaker: Yeah.] You have to, you often have to go in and set that stuff up. They're often not deleting on their own. So it's something that you have to go in and manage.

Rick Surber: Yep. All right. Okay. Well, you want to talk about procedures, Jen?

Jennifer Chadband: Yeah, yeah, we've talked about this a little bit. And this starts to get, I think, pretty kind of detailed as to what's entailed for developing and maintaining the AI system. This really is, again, it's data, records, information-centric. So although a lot of this might seem kind of IT in nature, it requires, I think, as we talked about, involvement with the business and potentially records managers as part of this process, to really ensure that the system is kind of meeting all the different requirements and is reliable on an ongoing basis. AI is a system, just similar to any type of system that the organization might develop or onboard. And so it has the validation and testing process. So that's just making sure that the tools are designed responsibly, that they're performing as expected, that they align with organizational requirements, as well as whatever the legal requirements are. And so thinking about what do we need to kind of document or think about as far as the processes to go through, we'll want to make sure that that AI system is really clearly defined.

What is it supposed to do? And then there's that data governance component. That's kind of a new thing we're seeing a little bit more and more: how do we govern that data, make sure that we're using high-quality, representative, accurate data, unbiased data, data that's legally compliant? How do we kind of set forth a governance that ensures that, not only initially, but on an ongoing basis? Validation protocols are really important, so that you're kind of testing the AI information against data sets to ensure that it's accurate. And then also the documentation is kind of an important part of this system development and maintenance. So keeping detailed records of what the model design is, and how you're training the data sources and governing the data sources, testing outcomes, et cetera. The input/output integrity checks, it speaks for itself a little bit. But on the input side, we're making sure that the data entering the AI system, again, is accurate, complete. Output: verifying that it is as it should be, such as classification labels or retention recommendations.

Are you benchmarking those against, kind of, and incorporating kind of a human review to make sure there's that level of accuracy that should be there? Do you kind of have a system to look for anomalies, whether that's kind of human, an element of human review again? But just kind of, if there's some sort of rule-based system that can be part of this system to flag for unusual patterns in the input or output data, or maybe there's a sudden spike in document deletions or some aberration like that, or misclassification. So tracking that kind of stuff is important. And again, they call it kind of the human in the loop. This is an interesting [inaudible] acronym, HITL.

So for high-risk outputs, the high-impact ones require human review before final action is taken. And then can't forget the continuous monitoring and audit mechanisms. There's something that's real, and it's called data drift. And so tracking the AI accuracy over time and make sure that, if the accuracy is dropping, there's an opportunity to correct that. Tracking audit, or having audit details tracked. So logging decisions that are made, actions, when and why, it's really kind of critical for legal defensibility for those systems. So that's really important. And just periodically, I think it's a necessity that the models have to be kind of retrained and redirected again. That goes along with that data drift again. But also the regulations evolve, the business needs evolve, things are evolving. So it's not something that just maintains itself. It has to evolve with the organization. So that's kind of an important part. And RIM managers play a hand in this. So it's just something to be aware of and think about with regard to your program. And next, why don't we talk about kind of our next slide here.

So, RIM efficiency goals. I think that this is really fun. And what we wanted to just kind of pull is some real-life examples of some strides or progress that have been made, organizations that have had success. What does this look like in real time? So here's an example: greater consistency and accuracy. We have an example, a government agency. So let's say they're kind of using this AI to classify different documents. So maybe it's licenses, maybe it's permits. And the AI capability introduced is able to consistently tag that information, those records, with metadata.

And that's based on the content analysis. So it's really kind of helping ensure that all of the documents are categorized correctly, essentially. Unlike what we are most accustomed to, the manual tagging, which is really prone to errors. People might interpret things differently, introduce their own subjectivity to it, and tag things differently. Things get lost, things get misclassified, misplaced. And so that really is just kind of an example of a real-life scenario where we're able to introduce AI and create greater consistency and accuracy, which ultimately leads to greater compliance.

So that's a great example there. Improved data insights and analytics: a health care provider uses AI to analyze patient records. And this includes, I would say, structured and unstructured data. So think of like unstructured, like doctor's notes, etc. And they're using this information with the assistance of AI to identify trends in admission rates. So they've kind of designed the system to flag patterns, such as maybe it's like frequent readmissions for certain types of patients, like maybe it's diabetic patients. And so being able to kind of flag that information, they derive from that, they can make decisions.

Maybe it triggers them to kind of review what their protocols are regarding the discharge of those patients, because they're readmitted so frequently. And so that's an example of using AI for structured and unstructured records to gain new insights, previously having that structured data be a little bit more accessible in comparison to the unstructured. And I'll just kind of highlight these other two. So Rick, I think, did a really great job explaining what compliance monitoring can look like and how it can help. A real-life example, a financial institution, you're using AI to monitor email communications and document retention practices. So the AI can be used to kind of flag documents that are scheduled for deletion but are under legal hold. So that really kind of helps prevent the accidental destruction, ensures regulatory compliance, a very high-risk industry. So that's important. And—

Rick Surber: Music to the SEC's ears.

Jennifer Chadband: Absolutely. And it can really, it can actually provide just real-time alerts. So if somebody is literally trying to delete a document, you can get notice of that. And audit logs as well can help maintain those logs of different accesses and actions, which enhances compliance as well. And finally, here's a great example, I think: multinational corporations, a lot of our clients, knowledge of a client using AI to manage their HR records across all of their global offices. So the AI is capable of automatically, kind of essentially, archiving inactive employee files and apply the retention periods, retrieve, and also retrieve the documents on request. And so this has been really helpful because, in being able to manage it, it's kind of a scalability consideration. They can handle a lot more records across a lot of jurisdictions, across language barriers, etc. So this is a real kind of way that AI can really enhance and make things more efficient within a RIM program. So yeah, with those examples, I know we're a little short, so I'll hand it over to kind of sum it all up.

Rick Surber: Yeah. So to conclude, when used responsibly, AI enhances efficiency, risk management and insight extraction. If you aren't working with it daily or at least weekly, try to enhance your processes, because you are falling behind. There's a real risk of misuse. It might not even be intentional if proper governance, policies, oversight and processes aren't used. Even workshopping scenarios is an effective way to kind of figure these things out. Next actions: think about conducting an AI readiness assessment, maybe develop an AI governance framework, identify some pilot AI projects to build internal experience. And then our next action here at Zasio Virtual Coffee is maybe to dig into the weeds a little bit and either try to find or try to cover several high-use, higher-level use case scenarios, or maybe dig deep into one use case scenario, like file share cleanup. We'll have a survey after this where you can share your preferences.

[Slide: Next session: Virtual Coffee with Consulting, Session 33, "Buckets, Benefits, and Boundaries: HR Records in a Growing Privacy Climate," featuring Brandon Tuley (Senior Analyst) with Rick Surber and Jennifer Chadband (Senior Consultants). Thursday, Aug. 21 (08/21/2025) at 11 a.m. EDT / 9 a.m. MT. Registration link coming soon to your email. Zasio: (800) 513-1000, connect@zasio.com, zasio.com.]

Finally, to conclude, we're going to switch gears for our next Virtual Coffee and bring in our very own consulting analyst, Brandon Tuley, to discuss "Buckets, Benefits, and Boundaries: HR Records in a Growing Privacy Climate." Mark your calendars for August 21st at 11 a.m. We hope to see you there. Thanks, everyone, for your time and attention today. It's been fun. Thank you, everybody. I appreciate it.