September 2026

PDF Article

Automated public records requests are overwhelming government agencies. Before committing hours of staff time to a request generated by software, agencies should consider one simple question: Is there actually a person on the other end?

Software can now identify government agencies, locate public records portals, generate requests, submit them automatically, and potentially repeat that process across hundreds or thousands of agencies. What once required a person to compose an email or complete a form can increasingly be accomplished without meaningful human involvement.

For government records managers, this raises an important question: Does a computer program have the same right to request public records as a person?

In most states, public records laws were written long before autonomous AI agents and automated request systems existed. Their language generally contemplates a request being made by a “person,” “requester,” “citizen,” or similar human or legal entity.

Florida law, for example, provides that public records are open for inspection and copying by “any person.” Texas law similarly describes public access in terms of the rights of a “person.” Neither statute was written with autonomous software agents in mind.

That does not necessarily mean an agency can simply delete a request because it appears to have been generated by a bot. In most jurisdictions, the law has not yet clearly answered that question. Washington and Indiana law has. Respond to the request—but require a human to respond back.

The Problem Is Not AI-Assisted Requests

There is an important distinction between an individual using AI to help write a public records request and software independently generating and submitting requests with little or no human involvement. A requester using ChatGPT to draft a better request is not fundamentally different from someone using a template, asking an attorney for assistance, or copying language from another request.

The concern arises when automated systems begin submitting requests at scale.

An agency could potentially receive dozens, hundreds, or even thousands of requests generated automatically. Those requests may require staff to search multiple systems, retrieve records, review exemptions, conduct redactions, calculate fees, upload large files, and communicate with departments throughout the organization.

Yet there may be no actual person waiting for the records.

That creates an obvious operational risk: government employees could spend significant taxpayer-funded time processing requests that no human being ever reviews.

Some States Are Beginning to Address Bots Directly

A few states have begun modifying their public records laws to recognize this issue.

Washington expressly addresses what it calls a “bot request.” RCW 42.56.080 defines a bot request as one an agency reasonably believes was automatically generated by a computer program or script. Under certain circumstances, an agency may deny one of multiple bot requests received from the same requester within a 24-hour period when responding would excessively interfere with essential agency functions.

Indiana went further in 2026. Its amended Access to Public Records Act authorizes agencies to establish electronic request portals incorporating CAPTCHA or an equivalent mechanism designed to ensure that the requester is human. The law also permits agencies to identify suspected automated, phishing, or data-scraping activity and provides additional protections for agency information systems.

These laws may be early indications of where public records legislation is headed. But most records managers do not currently have a statute specifically telling them what to do when a bot submits a request That is where sound records-management procedures become important.

The Human Confirmation Approach

Rather than immediately rejecting a request because it appears automated, an agency should build in a human-in-the-loop step, when permitted under applicable state law. The agency should first acknowledge the request in the same manner it would acknowledge any other request. If there are reasonable indicators that the request was generated or submitted automatically, the agency could then communicate with the requester and ask for an affirmative response before substantial processing begins. For example:

• We have received your public records request. Please reply to this message confirming that you submitted the request and would like the agency to proceed with processing it.
• A legitimate requester can answer that question in a few seconds.
• A completely autonomous system may not.
• The goal is not to make obtaining public records difficult. The goal is to establish that there is actually a requester participating in the transaction.

Fees Provide Another Natural Confirmation Point

Requests involving significant staff time, duplication expenses, video production, extensive redaction, or other allowable charges provide another opportunity to establish human involvement. Suppose an automated request seeks thousands of records. Rather than immediately spending dozens of staff hours retrieving and reviewing them, the agency may be able to prepare a legally authorized cost estimate and communicate it to the requester. For example:

• The estimated cost to fulfill your request is $XXXX. Please confirm that you would like the agency to proceed and that you agree to pay the applicable charges.
• The agency should then wait for whatever confirmation or payment its state law allows before undertaking the chargeable work.

Before committing substantial government resources, establish that someone actually wants the records.

Look for Indicators of Automation

Records personnel should avoid assuming that every unusual request was generated by a bot. A broadly worded or poorly written request can still come from a very real person. Instead, agencies should look for combinations of indicators such as:

• Numerous requests arriving within seconds or minutes of one another.
• Nearly identical requests submitted to multiple departments.
• Requests containing obvious computer-generated variables or repetitive formatting.
• Requests submitted at a frequency that would be difficult for a person to generate manually.
• Email accounts that never respond to agency correspondence.
• Requests repeatedly abandoned when clarification, payment, or confirmation is required.
• Automated interaction patterns associated with data scraping.

No single factor necessarily proves that a request was automated. The agency’s objective should be verification, not accusation.

Do Not Ignore the Request

One of the worst approaches may be simply deciding that a request “looks like a bot” and deleting it. Unless state law specifically authorizes that action, doing so could expose the agency to unnecessary legal risk. A suspected bot request should trigger communication—not silence. Acknowledge the request within whatever timeframe your state requires. Document why the request appeared automated. Send an appropriate confirmation, clarification, cost estimate, or other lawful communication. Then document whether the requester responded. This creates an administrative record demonstrating that the agency acted reasonably and attempted to communicate with the requester. It also gives a legitimate human requester an easy way to move the request forward.

Agencies Should Establish a Written Procedure

Records managers should begin discussing bot-generated requests with agency leadership, legal counsel, and information technology personnel before they become a significant problem.

A written procedure might establish the following workflow:

1. Receive and acknowledge the request. Do not disregard statutory acknowledgment or response requirements merely because automation is suspected.

2. Identify reasonable indicators of automation. Document objective facts rather than simply labeling the requester a bot.

3. Send a human-confirmation communication. Where legally permissible, ask the requester to confirm that the request should proceed.

4. Use clarification and fee procedures when appropriate. If the request is unclear, extraordinarily broad, or subject to legally authorized charges, communicate those issues before investing substantial resources.

5. Document the response—or lack of response. Maintain the correspondence as part of the request history.

6. Proceed when a human confirms the request. Once the requester responds, process the request according to the same laws and procedures applicable to other requesters.

7. Consult legal counsel before closing an unconfirmed request. State laws differ considerably regarding abandonment, clarification, deposits, response deadlines, and an agency’s ability to require information from a requester.

Agencies should not turn “human verification” into an additional legal requirement that their state’s public records law does not authorize. Some states restrict the information an agency may demand from a requester or prohibit inquiry into the purpose of a request. The process should therefore be designed with agency counsel and tailored to the jurisdiction.

Public Records Laws Were Written for People

Public records laws exist so people can understand what their government is doing. Automation can certainly make that process easier. Researchers, journalists, attorneys, businesses, advocacy organizations, and ordinary citizens will increasingly use AI tools to identify and request government information. But there is an important difference between technology helping a person exercise a right and technology independently consuming government resources without meaningful human participation.

Records managers are increasingly going to find themselves at that intersection. Until more legislatures specifically address autonomous public records requests, the most practical approach may not be to fight the bots. It may simply be to ask: “We received your request. Please confirm that you would like us to proceed.”

If there is a person on the other end, the records process continues. If nobody answers, the agency may have learned something important before spending hours searching, reviewing, redacting, and producing records.

Use Technology

The most advanced public records system available, GovQuest includes automated bot-detection technology on request forms which detect if a bot is being used to submit a request. If a bot is detected, the request cannot be submitted. Request a demo at govquest.com