At RelFest Chicago this year, I conducted an interview with Hannah Woodruff, Director of Product Management for Data Breach Response at Relativity, to discuss a new capability that expands Relativity aiR’s automated detection and linkage of personal information (PI) and protected health information (PHI) to impacted individuals in image-based content. Here are the highlights of that interview.

Executive Summary

Relativity is integrating advanced vision models, referred to broadly as Relativity aiR’s vision agent, across its AI platform for legal data intelligence. This initiative enhances Relativity aiR’s Data Breach Response capabilities, as well as custom analyses in aiR Review.

The core purpose of Relativity aiR’s vision agent is to help automate the processing of handwritten documents, scanned image files, and complex forms that historically bypass standard Optical Character Recognition (OCR) and keyword searches. By utilizing context-aware, purpose-built AI agents, the platform detects PI/PHI and links related information to help expedite the generation of entity notification lists following a cyber breach, with human reviewers validating the results.

Key highlights include:

• Product Availability: At the time this interview took place, Relativity aiR’s vision agent was in Advanced Access with select customers and has since become generally available.
• Market Landscape: Notification costs rose approximately 67% from 2021 to 2026, based on Woodruff’s calculation using data from IBM’s 2025 and 2026 Cost of a Data Breach Reports.
• Platform Growth: Relativity has experienced a 4x growth YoY in cyber-related data entering its platform.
• Governance: Relativity aiR’s vision agent operates under a human-in-the-loop model, shifting reviewers’ time to focus on quality control of results benchmarked against synthetic document sets.

Core Technical Capabilities and Problem Solving

Limitations of Traditional Processing

Traditional cyber response and legal review mechanisms rely heavily on standard OCR, regular expressions, and keyword search strings. These tools face significant limitations:

• Challenges with Handwritten Text: Handwritten healthcare/hospital notes, financial forms, scanned passports, driver’s licenses, and letters can yield poor or unusable OCR text, often requiring an extensive manual review.
• Lack of Contextual Understanding: Traditional keywords and regular expressions cannot establish semantic associations. For example, standard tools struggle to connect a name mentioned in text directly to an address or phone number written alongside it.
• Inability to Process Unstructured Visual Layouts: Non-agentic AI cannot parse layout context, such as identifying a return address situated in the upper left corner of a mailed letter or differentiating a blank/fake filler form (e.g., an empty W-9) from a document containing legitimate personal data.

Capabilities of Vision Models

Relativity aiR’s vision agent helps address these gaps by interpreting visual layout, structure, and context alongside textual content:

• Context-Aware Extraction: Context-aware agents analyze formatting cues alongside text to associate entities (e.g., linking a specific individual to their corresponding address).
• Form Layout Recognition: The models evaluate whether handwritten content on forms constitutes legitimate actionable data or invalid filler text.
• Cross-Platform Prompting Infrastructure: Built on shared platform capabilities, the solution’s purpose-built agents automatically detect image-based content, formulate appropriate prompts, send them to the vision models for inferencing, and return high-value results, such as personal information associated with an impacted individual, into the workflow for human validation and quality control.

Targeted Product Applications

Relativity applies vision capabilities across two main product areas, leveraging shared platform AI architecture to fulfill distinct use cases:

Capability	Primary Focus	Key Capabilities & Target Data
Data Breach Response	Expediting post-breach entity identification and notification list generation.	Highly targeted at identifying PI/PHI and associating it with the relevant impacted individual within handwritten notes, hospital records, scanned passports, driver’s licenses, and financial forms (e.g., W-9s).
Custom analyses in aiR Review	Flexible, customizable visual analyses for broad litigation and review workflows.	Customizable detection rules, including logo identification and searching for specific visual media or targeted content within photo collections.

Workflow Integration, Quality Assurance, and Accuracy

Relativity aiR’s vision agent fits into the existing Data Breach Response workflow, with human review and quality control built into the process, as follows:

1. Start with an ingested image or handwritten document
2. Within the Data Breach Response workflow, the purpose-built agent analyzes the context of the image, detecting PI/PHI and linking with relevant impacted individuals
3. The fielded analysis output is generated
4. A human reviewer uses the fielded analysis output to jump to a direct page citation (e.g., Page 5 / 8)
5. Results are displayed on an Entity Notification Report

Unified Review Workflow

• Fielded Data Extraction: Extracted analysis is converted directly into fielded output displayed alongside the original document viewer rather than hiding behind raw metadata fields.
• Page-Level Transparency: Reviewers receive precise page citations (e.g., identifying that an individual’s name and address appear specifically on page 5 or page 8 of a document). Clicking the citation jumps the reviewer directly to the page for verification.
• Entity Notification Reporting: Once verified, extracted entities automatically populate the final impact and notification report required by regulatory authorities.

Quality Control and Hallucination Mitigation

• Human-in-the-Loop: Human validation confirms AI-extracted findings before notifications are finalized.
• Synthetic Document Benchmarking: Relativity subjects all models to rigorous internal benchmarking prior to release. Models are evaluated against synthetic document sets designed to mirror real-world production environments to help optimize prompt results, test to understand when hallucinations may occur, and warn users accordingly.

Cyber Market Landscape & Strategic Context

The expansion of image-based detection directly aligns with key macro trends identified in the cybersecurity landscape:

• Rising Costs: Looking at IBM’s Cost of a Data Breach Report from 2025 and 2026, notification costs increased from about $0.27M in 2021 to about $0.45M in 2026, representing a roughly 67% increase (Woodruff’s calculation based on IBM data).
• Targeting of Complex Data: Cyber attackers increasingly target complex, non-standard data types. Breaches frequently involve sensitive API keys, specific medical diagnoses, and special categories of data strictly protected under regulations like GDPR (e.g., religious affiliation). These data types are inherently difficult to identify using standard search terms.
• Surging Ingestion Volumes: Relativity reports a 4x increase YoY in the volume of cyber-related data uploaded to its platform, necessitating automated, scalable image-processing tools to manage the load.

Rollout Status

• Current Status: When this interview took place, Relativity aiR’s vision agent was in Advanced Access, with select customers actively testing and providing feedback.
• General Availability (GA): Since then, Relativity aiR’s vision agent has been released for general availability.

So, what do you think about the application of AI vision models to data breach response? Please share any comments you might have or if you’d like to know more about a particular topic.

Note: This write-up from a recorded interview was prepared with the assistance of Gemini Notebook from Google and reviewed and edited by both Hannah and me for accuracy.

Disclosure: Relativity is an Educational Partner and sponsor of eDiscovery Today

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.