By Nico Van der Beken, Lead Forensic Expert
Artificial intelligence is already deeply embedded in modern forensic technology work. In our engagements we routinely combine commercial AI services, large language models, specialist machine-learning tools and privately hosted AI platforms to process documents, images, audio and video, translate material, extract information and prepare reports.
So the question is no longer whether AI should be used. It already is, and where it performs reliably it should be used aggressively.
The more important question is whether an entire forensic workflow can safely be handed to AI without specialist oversight. Today, the answer is no.
Three levels of maturity
Not every task is equally ready for automation. We find it useful to think in three categories:
- Mature: suitable for systematic use within a controlled, validated workflow.
- Assistive: highly useful, but material findings should be verified.
- Caution: good for generating leads and hypotheses, not as the sole basis for an evidentiary conclusion.
| Activity | Maturity |
|---|---|
| Metadata extraction, file processing, OCR | Mature |
| Exact and near-duplicate detection | Mature |
| Extraction of people, organisations, places and dates | Mature |
| Technology-assisted review and relevance classification | Mature |
| Machine translation and audio transcription | Mature / Assistive |
| Summaries, chronologies and relationship mapping | Mature / Assistive |
| Handwriting recognition and face identification | Assistive |
| Authenticity and deepfake assessment | Assistive |
| Evidentiary interpretation and final conclusions | Caution |
Evidence acquisition and preservation is a special case. Deterministic forensic tools remain the right choice there, and AI should not replace preservation controls.
None of this is new in principle. Technology-assisted review has been used in eDiscovery for more than a decade, with subject-matter experts training and validating the models. The same logic now applies to generative and multimodal AI. The technology can do an enormous amount of the analytical work, and validation and governance decide how far its output can be relied on.
Extraction is not conclusion
AI performs best when the task is framed as information extraction. Compare two instructions:
“Find every person named in this collection and show me the document, page, timestamp or video frame where each name appears.”
“Find every person in this collection, work out who they really are and what role they played.”
The first can now be heavily automated. The second bundles several distinct problems:
- recognising that different spellings, aliases or transliterations refer to the same person;
- telling apart different people who share a name;
- linking faces, voices, accounts and documents to individuals;
- judging whether statements in the evidence are reliable;
- resolving contradictions; and
- deciding whether there is enough evidence to support a conclusion at all.
AI can help with every one of these steps. That does not mean it should make the final call on its own. Generative models are built to produce plausible answers, even when the evidence is incomplete or ambiguous. In forensic work, plausible and proven are very different things.
Why expertise still matters
Experts are not still needed because humans read faster or recognise names better than modern AI. Increasingly, they don’t. They are needed because:
- Someone has to design the workflow. An investigation is not one prompt. It is a chain of processing, OCR, transcription, translation, entity extraction, computer vision and language models, chosen to fit the evidence and the question. An error early in the chain spreads through everything after it.
- Performance has to be measured, not assumed. A model that works well on clean English documents may behave very differently on degraded scans, handwriting, mixed alphabets, accented speech or specialist jargon. It needs testing against representative data. The NIST AI Risk Management Framework makes the same point: trustworthiness has to be demonstrated, not inferred from apparent capability.
- Ambiguity needs judgement. Two references may be the same person, or two people with the same name. A face may resemble someone without being them. A document may simply be wrong. These are questions of evidentiary weight, not processing.
- Findings must stay traceable. If a system says that a person appears in the evidence, an investigator must be able to go straight to the page, image or recording segment that supports it.
- Evidentiary integrity still applies. Provenance, preservation, documentation and reproducibility don’t go away with automation. If anything, more automation makes them more important.
AI-first, human-controlled
We don’t think the right model is a traditional review with the occasional AI tool, or an autonomous AI pipeline that takes in evidence and produces conclusions.
The right model is AI-first, human-controlled. AI processes as much of the evidence as is technically and legally appropriate. It extracts, classifies, transcribes, translates, clusters, prioritises and summarises at machine scale. Human effort then goes where it adds most value:
- validating significant findings;
- resolving identity questions, contradictions and exceptions;
- confirming translations and transcriptions that matter;
- assessing whether the evidence supports a conclusion; and
- taking responsibility for what is ultimately reported.
The bottom line
AI can already do a very large part of the work, and we use it extensively. The aim is not to protect work that could be automated. Mature capabilities should be automated wherever they save time, cost and unnecessary review.
The value of forensic technology expertise now lies in knowing what can safely be automated and how to combine and validate the tools. It also lies in seeing where extraction turns into inference, and judging when the evidence is strong enough to stand behind.
AI does not remove the need for forensic expertise. It changes where that expertise is applied.