How a government agency drafts FOI responses in minutes with Microsoft Copilot

The deadline an FOI team can’t reset

An FOI request starts a clock the agency does not control. Under the Freedom of Information Act 1982, and the equivalent state FOI and RTI regimes, the agency has a set number of days to acknowledge a request and decide it. The volume is uneven, the requests are often broad, and each one means reading, searching records, weighing exemptions and writing a careful reply. The same officers also field ministerial and public correspondence with its own expectations. The work is genuine. The trouble is how much of it is reading and first-draft writing.

Most of an FOI officer’s day is not the decision. It is the lead-up. Working out what a request is really asking, finding the relevant emails and documents, separating what is in scope from what is not, drafting an acknowledgement, then drafting a first-pass response that can be checked against the exemptions. By the time the judgement call arrives, much of the clock has already gone to the sorting and the typing. When a few large requests land together, the queue stretches and the statutory deadline gets uncomfortably close.

The usual fixes do not hold. More templates help with wording but not with reading. A standalone AI tool bolted on the side means moving sensitive records out of the agency’s controlled environment, which is a non-starter for an FOI or correspondence team handling exempt and personal material. Anything that touches this work has to sit inside the agency’s existing controls, respect its records-management obligations, and handle personal information under the Privacy Act 1988. The bar is high for good reason.

Why Microsoft Copilot inside Microsoft 365

The version that works is Microsoft Copilot doing the drafting and triage inside the agency’s own Microsoft 365, not a separate tool sitting outside it. The requests, the records and the correspondence already live in Microsoft 365. Copilot reads an incoming request, identifies the likely document set, drafts an acknowledgement and a first-pass response, and notes possible exemptions for an officer to confirm. The officer reviews, decides and signs off.

Keeping it inside Microsoft 365 is the part that earns its place, so it headlines the build. Copilot inherits the agency’s existing permissions, so it only sees what the officer working the request could already see, with no new data store and no records leaving the controlled environment. A separate tool would mean copying sensitive material out, building fresh access controls, and explaining a second system to an auditor. Working in the tools the team already uses also means the draft lands where the officer expects it, in the document and the inbox, not in another application.

The supporting pieces sit around that core. Microsoft 365 holds the records, the correspondence and the permissions Copilot works within. Microsoft Teams is where the team coordinates a request, hands it between officers and keeps the review visible. The scope is deliberately narrow. Copilot drafts and triages. It does not release a document, finalise a decision or make an exemption call. Every response passes a human-review-and-approve gate before it leaves the agency, and the officer owns the FOI decision.

Building it, and where it got hard

The model was rarely the hard part. The risk was, and one problem stood above the rest. An AI that drafts a response is dangerous the moment it surfaces exempt or sensitive material it should not, or states a fact that is not in the record. In FOI that is not a quality issue. It is a release of information the agency was obliged to withhold, against a legal deadline that does not move. “Mostly right, usually safe” does not pass when a single wrong release is a breach.

The fix had four parts and none of them was a cleverer prompt. First, scope. Copilot was pointed only at approved document sets, under the agency’s existing Microsoft 365 permissions, so it could never reach material an officer could not. Second, the gate. A human review and approval sat before any release, with nothing leaving the agency until an officer had read and signed it. Third, the prompting. Copilot was instructed to draft conservatively and to flag anything that might be exempt under the Freedom of Information Act 1982 for the officer to confirm, rather than deciding the exemption itself. Fourth, grounding. The drafts were tied to the retrieved records, so the officer could check each claim against a source instead of trusting the wording.

Two further constraints shaped the rest. Statutory timeframes are hard deadlines, so the tool tracked the due date for each request and surfaced the ones at risk early, while leaving the judgement about extensions and consultations with the officer. And because every request and response is a potential public record, the work stayed inside Microsoft 365 so the agency’s records-management and retention obligations were met by the system it already runs, not bolted on afterwards.

What changed

In a representative deployment the acknowledgement and a structured first-draft response were ready in minutes rather than most of a day, while the officer still reviewed and approved everything before it left the agency. Roughly half of incoming requests were sorted and routed at intake, with the likely document set and possible exemptions flagged for an officer to confirm rather than decided for them. Statutory due dates were tracked against each request, so the cases drifting towards a breach were visible early instead of on the deadline.

These figures are illustrative. They describe the pattern we see rather than a published result for a named agency. The shape is the point. The reading, sorting and first-draft load comes off the officer, the team spends more of the clock on the parts that need judgement, and every release still passes through a person who reviews it, decides it and owns the FOI outcome. The tool drafts and triages. The officer signs off.

Where this fits

FOI and correspondence drafting is one application of our Automation and Efficiency service, built on Microsoft Copilot, for an Australian government agency. It is a contained, high-volume, judgement-light part of the work that an assistant inside Microsoft 365 is genuinely suited to, and a sensible first step before anything more ambitious. If your FOI queue is wearing your officers down on the reading and the first drafts, the place to start is to map the workflow and decide exactly where a person must stay in the loop.