Laserfiche Security and Compliance

Security Certifications and Compliance Frameworks

GovRAMP

Pending

Laserfiche will achieve GovRAMP Verified status, demonstrating its implementation of security controls aligned with GovRAMP and NIST SP 800-53. 

Contact us for more information.

CJIS Ready

Laserfiche Cloud supports CJIS-ready controls that help organizations securely manage Criminal Justice Information (CJI). Enterprise Security provides enhanced auditing, monitoring, encryption and administrative controls that address CJIS and other security requirements.

Contact us for more information.

SOC 2 Type 2 Plus

This report details the controls for Laserfiche Cloud related to the criteria for the security, availability and confidentiality principles set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA, Trust Services Criteria). To view a copy of this report, please contact us.

ISO/IEC 27001:2022

Laserfiche has obtained the ISO/IEC 27001:2022 certification for its information security management system (ISMS) within the scope defined by its Statement of Applicability, covering its suite of SaaS and self-hosted enterprise content management and process automation applications.

HIPAA

Laserfiche’s SOC Type 2 Plus covers the security requirements set forth in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), provided within Title 45 Code of Federal Regulations Sections 164.308 – 312 (45 CFR Sections 164.308-312) (the Security Requirements).

Web Content Accessibility Guidelines 2.2 AA

Laserfiche has published VPATs and ACRs available for all Laserfiche Cloud and self-hosted products. Alignment to the WCAG 2.2 Level AA standard is the basis of our approach to compliance with Section 508 and EN 301 549 requirements. See accessibility details…

DoD 5015.2

DoD 5015.2 details the Department of Defense’s baseline requirements for Records Management Applications (RMA), that facilitate adequate and appropriate basis for addressing the basic challenges of managing records in the automated environment that increasingly characterizes the creation and use of records. Laserfiche Cloud records management controls are based on our self-hosted Department of Defense 5015.2 version 3-certified electronic records management capabilities.

SEC Rule 17a-4

Laserfiche features support non-alterable record archival requirements such as WORM (write once, read many) used to address SEC Rule 17a-4 for broker dealers. Beyond financial services, Laserfiche’s controls can also be applied to support records management practices for electronically stored information (ESI) requiring prevention of any unauthorized alternations or deletions of digital records.

HECVAT

Laserfiche has completed the Higher Education Community Vendor Assessment Toolkit (HECVAT) questionnaire. Contact us for more information.

NIST 800-53

Laserfiche security controls are aligned with NIST 800-53.

AI Security and Governance

Laserfiche AI services are provided using AI models and services from OpenAI. For information on AI services in regions where OpenAI is not available, please contact us.

Laserfiche AI
Our AI FAQs
Laserfiche AI security visualization

Regional data privacy requirements

Laserfiche AI addresses privacy and security standards of our current data center locations supporting GDPR (EU), CCPA/CPRA (USA), and PIPEDA (Canada) for low to moderate risk data. Our AI features are architected to support regional and industry-specific compliance needs, providing the same level of data sovereignty and protection you expect from Laserfiche Cloud.

For more information related to Laserfiche AI and data privacy, refer to the following:

You own your data
  • You retain ownership of inputs you provide. While Laserfiche owns the intellectual property rights to the outputs generated by our AI tools, we grant you a broad license to use those outputs for any of your organization’s internal business needs.
  • Laserfiche does not use your organization’s data to train any internal or external AI models. Your data is used only as needed to deliver services and to meet our legal and regulatory obligations.

Laserfiche AI user prompts

Laserfiche designs its AI features with safety and security as core principles. We manage prompting risks through two layers of protection:
  • Prompt-less by design: Many Laserfiche AI features, such as Document Summarization, do not use user prompts, reducing risks associated with accidental or malicious prompting.
  • Enterprise-grade safeguards: For features that do accept user input, like Smart Fields and Smart Chat, we employ industry-standard protections against prompt injection. These include input filtering, validation, and other controls that keep prompts and responses within defined, limited boundaries.

Content confidentiality

Your confidential content is not accessible to other customers or unauthorized third parties. Laserfiche distinguishes between two types of data:
  • Your confidential content: Laserfiche does not sell your data. Documents, files, and inputs you upload to Laserfiche are your own content.
  • Usage and system data: Like most cloud providers, Laserfiche collects limited, high-level usage data (such as feature adoption and system performance metrics) to operate and improve the platform. This data is de-identified and does not include the contents of your documents or AI prompts.

Data retention
  • OpenAI may store the prompts you enter or the responses you receive temporarily for up to 30 days to provide services and identify abuse. After 30 days, API inputs and outputs are removed from their systems, unless they are legally required to retain them. For more details, please refer to the OpenAI Services Agreement.

Security Controls

Below are some of the security controls Laserfiche software includes. If you have questions about a particular security solution or control, please contact us directly.

Single sign-on

Laserfiche Cloud supports single sign-on with Active Directory Federation Services (AD FS) and SAML authentication with identity providers such as Okta and Azure Active Directory.

Repository audit log

The Laserfiche Cloud repository audit log includes details of user actions, including viewing, modifying, creating and deleting documents, and similar operations on metadata and other repository objects.

Fine-grained access control

Administrators can use access rights to limit and control access to individual documents and objects. For example, security tags restrict access to documents on a document-by-document basis.

Intrusion detection

Laserfiche Cloud utilizes host-based intrusion detection systems to reduce the risk of data theft by individuals or organizations attempting to gain unauthorized access.

Access rights

Administrators can configure access rights and privileges to limit actions that users can perform across the repository based upon role assignments or group memberships.

AI governance

Laserfiche AI data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Laserfiche does not utilize any of your data to train internal or external AI models.

Password policies

Laserfiche Cloud supports industry-standard password controls, such as password minimum length, complexity and history.

Penetration testing

Laserfiche engages third-party vendors to conduct external penetration testing of the Laserfiche Cloud system.

Vulnerability scanning

Laserfiche performs a vulnerability scan of backend servers that run in the Laserfiche Cloud hosting environment.

Firewalls

Laserfiche Cloud’s firewall configuration settings are regularly reviewed based on industry standards.

Repository application auditing

Laserfiche Cloud supports auditing of both access and modification of objects in repositories.

Enterprise Security

Securely modernize your business-critical work with Laserfiche Cloud.

Laserfiche Enterprise Security enhances security, resilience and governance capabilities for organizations managing sensitive, highly regulated data in Laserfiche Cloud.1 It provides FIPS 140-3 encryption2, privileged-user activity visibility, configurable session controls and multi-region disaster recovery with near real-time account-level replication. 

Available to Laserfiche Cloud Business customers as an optional Add On, included with Business+ and offered for eligible Municipal Cloud packages.
Contact Us

Features 
  • Multi-region disaster recovery with near real-time repository replication  
  • Four-hour repository snapshots 
  • Enhanced user and privileged account monitoring  
  • Configurable security policies including inactivity session time out controls  
  • GovRAMP Verified and CJIS-ready 
Laserfiche Cloud Security Features Professional Tier Business TierBusiness+ Tier
AES‑256 Data Encryption  ✓ ✓ ✓ 
Role‑Based Access Controls ✓ ✓ ✓ 
Single Sign‑On (SSO/SAML/AD FS) ✓ ✓ ✓ 
DDoS Protection ✓ ✓ ✓ 
Unauthorized AI Bot Prevention ✓ ✓ ✓ 
Administrative and Repository Auditing✓ ✓ ✓ 
Configurable Inactivity Timeouts✓✓ ✓ 
Advanced Audit Trail   Add On✓ ✓ 
FIPS 140-3 Cryptographic Modules  ✓ 3✓ 
Four-Hour Repository Snapshots  ✓ ✓ 
Multi-Region Disaster Recovery Support  ✓ ✓ 
GovRAMP (Pending)  ✓ ✓ 
  1. To ensure alignment with regulatory and operational needs, organizations should evaluate their use cases against the acceptable use restrictions in our Cloud Subscription Agreement before making a purchase.  ↩︎
  2. Note: Enhanced encryption uses FIPS-compliant cryptographic algorithms (FIPS 140-3) that utilize up-to-date crypto routines approved by NIST and compiled to help prevent sophisticated attacks on underlying cryptographic algorithms. Enhanced encryption is available for the Laserfiche Cloud U.S. Region.  ↩︎
  3. Items with an orange check-mark (“FIPS 140-3 Cryptographic Modules” and below) are available with the Enterprise Security Add On for Laserfiche Cloud Business customers, included with Business+ and offered for eligible Municipal Cloud packages. ↩︎
“Laserfiche’s compliance tools in the cloud, and knowing that Laserfiche takes security very seriously have been important factors in our decision making.”rn—Andrew McElrath, strategic project manager at Mille Lacs Corporate Ventures
Featured Success Story

Mille Lacs Corporate Ventures Transitions Corporate Operations to Laserfiche Cloud

Mille Lacs Corporate Ventures (MLCV), created by the tribal government of the Mille Lacs Band of Ojibwe, manages the business affairs of the Band.

Read the Case Study

Laserfiche is committed to privacy.

Our commitment

At Laserfiche, we have embraced a culture of privacy, which includes embedding privacy-by-design in our engineering efforts, and have implemented controls and policies throughout our organization. Laserfiche is a B2B company based in California. The State of California has passed strict, broad privacy regulation through the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) while the General Data Protection Regulation (GDPR) leads the European Union’s privacy efforts. Many other countries, states and territories have implemented privacy regulations as well. Laserfiche endeavors to continually adapt and adhere to ever-evolving regulations that apply to its business.

Operational privacy

Operationally, we strive to keep our stakeholders’ data secure and retain only information we collect from you where we have an ongoing legitimate business need to do so, like providing you with a service you have requested, or to comply with applicable legal, tax or accounting requirements.

Privacy training

At Laserfiche, all employees are required to complete annual privacy training which covers applicable privacy regulations and data handling best practices.

Laserfiche documentation

In addition to what we communicate in our Privacy Notice, our Cloud Subscription Agreement with accompanying Data Processing Addendum specific to the Laserfiche Cloud platform addresses data privacy regulations including GDPR, CCPA and PIPEDA.

International transfers

For personal data transferred from the United Kingdom, the European Union and Switzerland, we provide appropriate safeguards per the Data Privacy Framework. To learn more, visit the “International Transfers” section of the Privacy Notice.

Information we collect

We collect information that you provide directly to us only for legitimate business purposes. For example, when you manage your user profile, participate in interactive features (such as the Contact Us page), request newsletters or other marketing communications, request customer support, enter login information, or otherwise communicate with us. To learn more visit the “Information We Collect” section of the Privacy Notice.

You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails we send you. To learn more, visit the “How Laserfiche Uses and Shares the Information We Collect” section of the Privacy Notice.

To read our complete Privacy Notice, visit our Privacy Notice page.

Contact Us for Your ECM Needs

Whether you have product questions, support needs or want to partner with us, we’re here to help you on your digital transformation journey. Fill out the form and a Laserfiche team member will be in touch as soon as possible.

From Complexity to Clarity: AI-Powered Information Management

Alex presenting with AI button callouts

In the modern enterprise, information is often compared to oil—a raw resource that is valuable only when refined. However, for many organizations, that “oil” has become a “swamp.” We are drowning in Ghost Content: the vast quantities of documents, emails, and data points that are stored daily, tucked away, and promptly forgotten. This hidden hoard isn’t just a storage cost; it’s a locked chest of insights and a potential compliance liability. 

In a recent thought leadership webinar, experts from Info-Tech Research Group and Laserfiche sat down to discuss how artificial intelligence is finally providing the key to unlocking your data, moving organizations from digital clutter to operational clarity. 

The New Information Landscape: Breaking Down Silos 

For decades, IT departments have drawn a thick line between “Data” (structured numbers in databases) and “Content” (unstructured documents like PDFs and emails). According to the Info-Tech experts, those lines are officially dead. 

AI doesn’t care about the format of your information. Whether it’s a row in a spreadsheet or a paragraph in a contract, modern AI agents see it all as Knowledge. To be “AI-ready,” organizations must stop managing these assets in silos. Integrating technology, architecture and governance teams is the first step toward a unified information strategy that is cost-effective and compliant. 

Nysa Zaran, data and analytics director of research at Info-Tech, emphasizes the importance of this shift, saying, “One of the moves that we need to begin to make as organizations is to think more broadly about our information as a whole, our knowledge, our data and our content, and start thinking about how we can manage that and leverage that together.” 

The Four Dimensions of AI 

To understand how to leverage this technology, Zaran breaks AI into four core capabilities that are reshaping the workplace: 
  1. Perception: The ability to interpret input, such as digitizing handwriting or transcribing speech. 
  1. Natural Language Processing (NLP): Democratizing access to data by allowing users to interact with systems using human-like speech. 
  1. Knowledge Representation: Providing context in complex environments and mapping how different pieces of information relate to one another. 
  1. Generative AI: The ability to co-create new content based on existing organizational knowledge. 

While some of these technologies have existed for years, their accessibility is what has changed. Tools that were once reserved for data scientists are now available at the fingertips of every office worker. 

Tackling the “Content Swamp” with Principles 

If you turn a powerful AI loose on a “content swamp”—a disorganized SharePoint or a messy file server—you won’t get insights; you’ll get amplified chaos. The experts suggest a principle-based approach to decide what information actually matters. Info-Tech proposes the “I-VALUE” framework. High-value information is: 
  • Irreplaceable 
  • Value-driving 
  • Authoritative 
  • Legally/Contractually relevant 
  • Unique 
  • Enabling to the organization 

By establishing these principles, leadership can share the responsibility of data ownership across the company, rather than leaving it solely on the shoulders of the IT department. 

Using AI to Prepare for AI 

One of the biggest misconceptions in digital transformation is the idea that “we aren’t ready for AI because our data is too messy.” The Info-Tech team flips this script: You can use AI to clean your house. 

This is where AI-powered information management comes in. Instead of manual audits that take years, organizations are now using AI for auto-classification, metadata prediction, and deduplication. You can use AI to identify personally identifiable information (PII) at scale or to flag expiring vendor contracts that were previously hidden in the depths of your archives. In this way, AI isn’t just the end goal—it’s the janitor that helps you get there. 

“Use your technology. It’s powerful,” said Andrea Malick, principal advisory director at Info-Tech. “Use it to its potential, and you’ll now be set up for emerging technology.” 

The Path Forward: Strategy Over Hype 

So, where should you start? The panel suggests a “strategic but practical” approach. You don’t need an “easy button”; you need a six-month roadmap. 
  • Identify High-Impact Use Cases: Don’t try to boil the ocean. Find one or two doable projects, like automating a construction foreman’s field notes or linking structured sales data with unstructured client emails to find new patterns. 
  • Focus on Literacy: Ensure your team understands what these tools are capable of and, more importantly, how to use them safely. 
  • Leverage Vendor Partners: Use platforms like Laserfiche that have already baked these AI capabilities into their ecosystem. From natural language extraction to AI agents that handle reasoning tasks, the tools to transform your “Ghost Content” into a competitive asset already exist. 

Reclaim Control of Your Information Ecosystem  

The shift from complex, fragmented data to clear, actionable intelligence isn’t just a technological upgrade; it’s a cultural one. By breaking down the barriers between data and content and using AI-powered information management to streamline governance, your organization can stop searching for information and start using it. 

To learn more about how to unlock your organizations unstructured data and hear directly from Research Directors of Info-Tech Research Group, watch the full webinar.  
Watch the Webinar 

AEOA Streamlines Community Services and Improves Access to Critical Programs

Delivering Time-Sensitive Services Across Northern Minnesota

Imagine facing a harsh winter without heat. Or struggling to put food on the table for your family. For many individuals and families across northern Minnesota, these challenges are a reality. Arrowhead Economic Opportunity Agency (AEOA) has a mission to help them. With programs spanning housing, energy assistance, Head Start, SNAP, senior services and transportation, AEOA delivers these critical services to thousands of Minnesotans each year.

The work is both high-volume and time sensitive. For years, much of it depended on paper files and manual processes. Across departments, staff managed large volumes of documentation by hand:
  • In the Energy Assistance Program alone, staff processed 8,000 to 9,000 applications annually, with each application requiring physical handling, filing and retrieval
  • The fiscal team managed 100 to 300 invoices weekly, often pulling and re-filing documents to support financial and compliance audits and reporting requirements
  • Human resources maintained personnel records for approximately 450 employees, stored in paper files that required manual filing, organizing and ongoing maintenance  
  • Housing and community programs relied on paper intake forms and manual processes to support high-volume client services across departments

These processes created delays at multiple points in the workflow. Staff often had to search across file cabinets, coordinate handoffs between teams or track down missing information. This made it harder for AEOA to respond quickly to community needs. It also provided limited visibility into where applications or documents were in the process, which made it especially challenging for managers and program leaders responsible for oversight and reporting.

“We were managing critical programs with systems that made it harder to move quickly,” said Emily Celley, chief financial officer at AEOA. “When your mission is to serve people in urgent situations, operational efficiency directly impacts outcomes.”
Arrowhead Economic Opportunity Agency

Building In-House Workflows to Support Evolving Programs

AEOA initially adopted Laserfiche to replace paper-based files and centralize how staff store, retrieve and manage program documents. Over time, use of the platform evolved into a foundation for how AEOA manages its programs, data and day-to-day operations.

Working with Laserfiche partner OPG-3, AEOA expanded Laserfiche across departments, building and refining workflows to meet the needs of each program.

“From the beginning, we weren’t looking to just digitize documents. We wanted to build processes that could grow with us,” said Celley. “The Laserfiche platform lets us continuously improve how we work.”
Arrowhead Economic Opportunity Agency

AEOA’s team now develops many of its Laserfiche workflows in-house, tailoring solutions to support high-volume, time-sensitive services. This allows the organization to quickly adapt processes as program requirements change without relying on extensive IT resources or outside development.

Streamlining Programs from Energy Assistance to Meals on Wheels

One of the strongest examples is the Energy Assistance Program. Previously, applications were managed as paper files, manually sorted and routed. Today, applications are batch scanned into Laserfiche and processed through automated workflows. Metadata determines how each application is categorized and routed, including directing urgent cases, such as households facing shutoff notices, into priority workflows. This eliminates the need to pull and manage physical folders and enables AEOA to identify and address time-sensitive cases more quickly.

Similar improvements extend across AEOA, where Laserfiche supports a wide range of high-volume, digital workflows across programs:
  • Housing: Applications for building rehabilitation and home ownership begin with simple digital intake forms. Submissions are then automatically routed through review and approval stages. Families can move through the process more quickly, supporting housing stability.
  • Education: Staff manage multiple form-based processes, including Head Start childcare acknowledgments and onboarding, ensuring information is collected consistently and stored securely across locations. Families experience a smoother path to accessing early education services.
  • Senior services: Programs like Meals on Wheels and volunteer coordination use intake forms and metadata-driven workflows to capture participant information and streamline service delivery. Seniors benefit from more reliable and better-coordinated support.
  • Transportation: Documents such as trip records, driver logs and program documentation are imported and organized using metadata, making it easier to manage high volumes of information and quickly retrieve records for reporting, compliance and daily operations. This results in more reliable transportation services for riders.
Arrowhead Economic Opportunity Agency

“Laserfiche fundamentally changed how work gets done across our organization,” said Celley. “Processes that once relied on manual coordination and paper are now faster, more consistent and easier to manage across teams and locations so services can reach people sooner.”

Moving to Cloud-Based Operations

As Laserfiche adoption grew, AEOA modernized its infrastructure by migrating to the cloud. Moving away from aging on-premises servers reduced the burden of system maintenance while improving accessibility for staff across locations.

A phased migration allowed AEOA to continue expanding its use of Laserfiche without being limited by infrastructure constraints. Today, the cloud environment supports ongoing innovation and gives staff faster, more reliable access to information across programs.
Arrowhead Economic Opportunity Agency

“Moving to the cloud positions us to continue evolving without being limited by infrastructure,” said Celley.  “That changes how quickly we can respond, both internally and to the people we serve.”

Strengthening Compliance Across State- and Federally Funded Programs

That same visibility also strengthens how AEOA manages risk, compliance and data security across its programs. The nature of AEOA’s work means it handles vast amounts of sensitive client and program data. Laserfiche enables the organization to control access to information based on roles, supporting confidentiality while maintaining accessibility for authorized users. The system also simplifies audit preparation by allowing staff to quickly compile documentation across thousands of records.

“In our environment, compliance and accountability are critical,” said Celley. “Laserfiche gives us confidence that we can meet those requirements while still operating efficiently.”

Advancing the Mission Through Greater Efficiency

AEOA staff now spend less time managing paperwork and more time supporting Minnesotans in need. “Our mission is to strengthen communities by providing opportunities for people experiencing social and economic challenges,” said Celley. “Laserfiche helped us remove barriers in our processes to better deliver on that mission.”

With a strong foundation in place, AEOA continues to explore new opportunities to optimize workflows, expand automation and improve service delivery across its programs. “Laserfiche allows us to operate more efficiently at scale,” said Celley. “This directly impacts how quickly we can deliver services to the communities we support.” 

Higher Learning Commission Improves Efficiency Across Accreditation Processes

Managing Decades of Records Across Nearly 1,000 Institutions

Accrediting a college or university isn’t a one-time event. It’s a continuous process that spans years and generates extensive documentation at every step, including evaluation reports, institutional filings, compliance materials and records.

For the Higher Learning Commission (HLC), an institutional accreditor that works with approximately 1,000 institutions to evaluate all aspects of their offerings and operations, managing this volume of records is essential to ensuring quality and accountability across higher education. HLC depends on accurate documentation and timely access to information.

“Behind every accredited college or university is a decade-long trail of documentation,” said Jon Davenport, CIO at HLC. “From initial evaluations to ongoing compliance reviews, we have hundreds of thousands of documents tied to institutions.”

Each institution’s accreditation cycle involves multiple review points and hundreds of associated documents. Over time, HLC digitized many records and relied on a legacy document management system. But as the organization grew, that system couldn’t effectively manage the volume and diversity of document types. Search functionality was inconsistent and slow. And retrieving records for accreditation reviews took valuable time.

Much of this work began in Salesforce, where staff manage institution data and track accreditation activity. However, accessing supporting documentation required switching systems and manually searching for records, adding friction to everyday workflows.

At the same time, retention processes relied on manual tracking. This created compliance challenges and increased the risk of human error.
Higher Learning Commission

Aligning Technology with Accreditation and Compliance Needs

HLC set out to find a more capable and scalable platform. To ensure the solution met both technical and day-to-day needs, HLC involved stakeholders across departments such as records management, IT, legal and regulatory affairs, human resources and accreditation operations in the selection process.

Joan Mitchanis played a key role in evaluating potential solutions and ensuring the platform could support HLC’s long-term records management requirements. “We needed a system that was built for content and records management,” said HLC’s records manager. “Retention, security and the ability to manage information over the long term were all critical considerations for us.”
Higher Learning Commission

After a detailed evaluation, HLC selected Laserfiche. It stood out for its records management capabilities, search functionality and automation tools.

Working with Laserfiche solution provider Modified Logic, HLC migrated hundreds of thousands of documents into a centralized repository. The team approached the project with careful planning, focusing on maintaining user familiarity while improving structure and performance.

The migration prioritized:
  • Clear metadata and document structure
  • Improved search and reporting
  • Automated retention policies
  • A scalable foundation for future workflows

This approach enabled a smooth transition and laid the foundation for continued growth and innovation.
Higher Learning Commission

“Laserfiche gives us the flexibility to build and improve processes as our needs evolve,” said Davenport. “We can automate workflows, improve access to information and continue expanding what the system can do.”

Transforming Everyday Work for Everyday Users

HLC quickly saw improvements across daily operations, particularly in how staff access and work with information. Teams can now search within documents, quickly locate key details and manage large volumes of records with greater ease. Combined with automation and system integrations, these changes reduce manual work, improve consistency and lower the risk of human error.
  • Faster, more accurate search. Laserfiche makes it easy for HLC to refine searches, reuse saved queries and surface the right information without starting from scratch. This is especially valuable when gathering documentation for accreditation reviews. “I can find exactly what I’m looking for the first time,” said Cheryl Rothwell, human resources and operations manager. “Being able to use relative date ranges, like the last 10 years, makes it much easier to pull the right records without extra work.” 
  • Simplified document handling. Laserfiche streamlined routine document management tasks for HLC. Files with duplicate names are automatically differentiated, reducing the risk of missing documents or overwriting files. Staff can also download large sets of documents at once, saving time and eliminating repetitive steps. “It’s the small improvements that matter most,” said Claire Boyan, accreditation processes coordinator. “Tasks like downloading large sets of documents now take about half the time.”
  • Automated records retention and compliance. Retention management is critical for HLC, which must meet strict regulatory and legal requirements. Laserfiche introduced structured retention policies with clear timelines and visibility, while also supporting litigation holds. These enable HLC to assign retention policies and to lock documents in place during legal procedures or formal investigations while continuing to add new records. “Laserfiche gives us confidence in our retention processes,” said Mitchanis. “It removes the risk of accidentally deleting something that should be retained.”
  • Streamlined feedback workflows. HLC regularly receives feedback from external stakeholders that requires careful documentation and timely communication. Previously, managing feedback involved several manual steps, including assigning retention policies and tracking documents individually. Laserfiche simplified key parts of this process. “What used to take two steps now takes one,” said Sarah Hallett, manager of legal and governmental affairs. “With the volume we handle, even small efficiencies like that save a significant amount of time.”
  • Seamless Salesforce integration. HLC integrated Laserfiche with Salesforce to improve access to records. Staff can now open institution-specific folders directly from Salesforce with a single click. “It’s become a bit of a magic button for our users, especially our leadership team,” said Will Mahoney, associate director of information technology. “They can go straight from Salesforce to the exact information they need without switching systems or searching.”

Advancing the Mission with Better Data Access
Higher Learning Commission

HLC staff now spend less time searching for documents and more time supporting institutions. Processes are faster and more consistent, with improved data accuracy and visibility across teams.

With a strong foundation in place, HLC continues to expand its use of Laserfiche. The organization created a governance group to prioritize new initiatives and evaluate opportunities for automation and process improvement. Future plans include expanding workflow automation, increasing use of Laserfiche Forms, enhancing integrations with internal systems and exploring AI capabilities. “Laserfiche helps us do our job better every day,” said Davenport. “It directly supports our mission of ensuring quality in higher education.”

AI Is Moving Fast. AI Governance Isn’t.

Just 38% of employees reported that AI use in their workplace is well regulated with clear policies and approved tools

AI is now part of everyday work. Employees are using it to summarize documents, find information, automate repetitive tasks and boost productivity. Meanwhile, organizations are beginning to explore agentic AI systems that can plan, make decisions and complete multi-step workflows with minimal human intervention.

As AI capabilities continue to evolve, organizations are under growing pressure to establish the policies and governance needed to support responsible adoption. To better understand how workplaces are managing this shift, Laserfiche surveyed 1,000 U.S. workers about AI usage, governance and expectations. Just 38% reported that AI use in their workplace is well regulated with clear policies and approved tools, up only slightly from 36% a year ago.

Governance is the Foundation for AI Success

The survey paints a mixed picture of AI in the workplace. While 38% of workers say AI is governed by clear policies, nearly one in four (24%) report that AI is not used at all in their workplace. Another 8% describe AI use as the “Wild West,” with no clear rules or oversight.

Whether an organization is actively deploying AI or just getting started, governance matters. Clear policies help employees understand which tools they should use, how AI-generated content should be reviewed and what data can be safely shared.

Without that foundation, organizations risk inconsistent adoption, security concerns and lower confidence in AI outputs.

Trust Depends on More Than the Technology

Employees are optimistic about AI’s ability to improve everyday work, but they also want reassurance that it will be used responsibly. Workers are most interested in using AI for practical, low-risk tasks such as checking for errors (36%), finding information instantly (34%) and handling repetitive work (33%).

At the same time, worker’s top concerns include AI work quality (24%), irreversible agentic AI actions (21%), process disruption (21%) and sensitive customer data being entered into AI models (20%).

The takeaway is clear. Employees see AI’s value, but trust depends on governance. Organizations need policies that promote transparency, protect data and ensure human oversight where it matters most.

Employees Want Guidance, Not Just AI Tools

Deploying AI is only part of the equation. Employees also expect organizations to help them use it effectively.

More than one-third (36%) want access to current AI tools and time to learn them. Others expect guidance on AI quality and risk (32%) and clear policies for appropriate use (31%).

Training and governance should evolve alongside AI capabilities. As new tools emerge, organizations that invest in both technology and clear guidance will be better positioned to scale AI with confidence.

Closing the Governance Gap

The past year has shown how quickly AI innovation can reshape the workplace. The challenge for organizations is making sure governance keeps pace.

At Laserfiche, we believe responsible AI adoption starts with empowering employees while ensuring organizations maintain control over their information and processes. Successful AI adoption is not defined by how many tools an organization deploys. It depends on whether employees have the guidance, processes and confidence needed to use AI responsibly, securely and consistently.

As AI becomes more embedded in everyday work, organizations will need to think beyond individual tools and focus on building trusted processes around how information is accessed, managed and used. The organizations that succeed will be those that pair AI innovation with the governance, transparency and operational foundation needed to turn experimentation into lasting business value.

For more insight on how to successfully deploy AI to drive digital transformation, download our eBook and see how leading organizations are closing the governance gap.
Download

Methodology  

The survey was conducted by Veridata Insights and commissioned by Laserfiche. It included 1,000 U.S.-based individuals aged 18 and over, census-balanced by age and gender.

Enterprise Security for Public Safety Organizations

Enterprise Security: Top Use Cases for Government & Regulated Organizations

Enhanced Enterprise Security: Removing Barriers to Laserfiche Cloud

Agentic AI and Security. Conversations from GITEX AI Europe 2026

People gathered at Laserfiche booth at GITEX AI Europe 2026

Coined the “Elektropolis” for its foundation of modern-day electrical engineering and industrialization, Berlin has been a hub for technological innovation in Europe for the past century. Given the history, it’s no surprise why it was chosen as the meeting place for over 30,000 tech and AI leaders at GITEX AI Europe 2026 this summer.

From the public sector to startups, investors and enterprise leaders, I had the opportunity to connect with the top minds and businesses pioneering Europe’s leading technology and innovation. Unsurprisingly, AI, particularly agentic AI, was at the forefront of every conversation at the event. But amidst the AI hype, a new buzzword quickly emerged: governance.

Unleashing Organizational Growth with Agentic AI

Agentic AI took center stage across the expo floor and numerous sessions, introducing a new meaning to AI assistance. Moving past LLM and chat models, AI agents are designed to act on your behalf.

The introduction of autonomous execution opens a new realm of possibilities for businesses to supercharge their operations. Processes that once took hours of human intervention can now be done by agents, saving valuable employee bandwidth, cutting costs, increasing efficiency and elevating data quality. Across Europe, leaders from every sector are now looking toward agentic solutions to not only accelerate core business functions, but to make meaningful impact at scale.

But with that massive potential comes a new layer of responsibility. Conversations around agentic technology quickly turned the spotlight onto security risks and the urgent need to comply with looming legislative mandates.

The AI Act: Europe’s Governance Mandates

Created to meet the rapid explosion of AI technologies, the AI Act was put into place in 2024 by Europe’s governing bodies to ensure the responsible adoption of AI across all 27 countries in the European Union (EU).

An official press release from the Commission describes the goal of the act stating:

“The EU aspires to be the global leader in safe AI. By developing a strong regulatory framework based on human rights and fundamental values, the EU can develop an AI ecosystem that benefits everyone.”

The act approaches AI governance with a four-tiered risk assessment and sets timelines for implementation. Deadlines for “High Risk” AI are quickly approaching on August 6, 2026, with extensions allowed until December 2, 2027. According to the European Parliament, High Risk refers to any system that could threaten people’s safety or basic rights, especially when used in critical areas like healthcare, transportation, law enforcement, education or hiring.

To navigate this landscape, businesses at GITEX must track two critical milestones:
  • August 6, 2026: Strict transparency and audit rules take effect. Companies must clearly label conversational chatbots, emotion-recognition tools and deepfakes. Additionally, every EU country must launch a simulated “AI Regulatory Sandbox” to give startups a safe place to test models.  
  • December 2, 2027: Standalone high-risk systems must be fully compliant. Any AI used to score exams, filter job applicants, manage critical infrastructure or assist law enforcement must be thoroughly audited, logged and registered in the EU database. 

Failure to meet the deadline requirements can cost organizations up to €15 million in penalty fees.

How Can EU Leaders Safely Compete? 

With the impending AI Act deadlines and the rise of agentic AI, numerous sessions and roundtables at the event centered around practical measures for businesses to safely compete with the leaders of tomorrow.

Presentations by session experts repeatedly surfaced one vital concept: information and data management. Before AI agents can make an impact, they need access to the right information. Without a clear and governed data infrastructure, agents lack the context they need to correctly perform business actions, opening the door for compounding compliance and security risks.

In addition to connected data infrastructures, agent actions must be transparent and auditable to meet the EU AI Act demands and maintain security. Combining information management and transparency is a key component to fostering trust, especially within the essential services, public sector and other critical industries outlined in Parliament’s legislation.

Navigating the Agentic Era at GITEX AI Europe 2026 

Europe’s businesses, startups and public organizations stand at a pivotal crossroad. While AI agents offer unprecedented opportunities for growth, this autonomous technology also introduces complex new compliance and security risks.

As the conversations at GITEX AI Europe 2026 made clear, transparency, information management and strict governance are no longer optional—they are imperatives for successful AI adoption. Far from holding innovation back, robust governance is the very catalyst that allows agentic technology to scale safely.

When implemented securely, AI agents liberate human ingenuity and drive true digital transformation.

Your future success starts now. Learn how AI-powered content management can help your organization navigate the agentic era with confidence, mitigate compliance risks and reach your goals faster than ever before.
Download the Agentic Playbook

Leading the 2026 AI Expansion in Government: Washington’s Data Governance Framework

Presenter in front of Laserfiche Washington user group

In 2026, AI expansion across government is accelerating at an unprecedented pace. This year’s Washington State Information Professional Management Association (IPMA) Forum brought together technology, business and management leaders to help public agencies navigate this landscape and map out the future of operational resilience and technical innovation. 

Conversations with public sector leaders made one thing clear: artificial intelligence (AI) is no longer a concept for the future—it is actively shaping everyday government operations. The defining question is no longer if agencies will adopt AI or even Agentic AI, but whether they are prepared to govern it responsibly. 

This marks a critical shift for state and local agencies navigating an environment defined by rising expectations, compounding information complexity and growing pressure to accelerate service delivery without compromising public trust. 

 Why Governance Matters More Than Ever 

Across IMPA sessions focused on modernization, records management, automation and digital transformation, three core themes emerged:   
  1. The Explosion of Unstructured Content: Documents, emails, forms, contracts, and case files continue to grow across disconnected systems. Much of this information lacks consistent metadata, making it difficult to find, govern or use effectively.  
  1. The Scalability Crisis: Manual processes no longer scale. Staff shortages, increasing compliance obligations and growing transparency demands are forcing organizations to rethink how work gets done. 
  1. The Governance Mandate: Leaders increasingly understand that AI only delivers value when it operates within trusted governance frameworks. 

These priorities closely align with a broader shift happening across government: moving from managing content as static records to treating information as a strategic operational asset. 

That is where content management is being reimagined. 

Leveraging AI in Document Management 

Traditionally, enterprise content management focused on storing, organizing, and retrieving documents. While those capabilities remain essential, they are no longer sufficient on their own. With the rapid growth of AI in local and state government, agencies today need systems that can help classify information automatically, surface insights quickly and support faster, more informed decisions. 

AI-drive document management is accelerating that evolution. 

At the forum, discussions around automation and AI repeatedly returned to practical use cases that agencies are actively exploring. Intelligent document classification, automated metadata extraction, AI-assisted records retrieval, and conversational access to information are no longer mere luxuries. They are becoming operational necessities. 

But what stood out most was the emphasis on responsible AI. 

Government leaders are understandably cautious. Public trust depends on transparency, accountability, and defensible decision-making. Agencies cannot afford black-box systems that operate without oversight or explainability. As AI capabilities expand, governance becomes more important, not less. 

Innovation Done Safely: Washington’s Framework for AI Governance 

Government leaders in Washington state are already establishing formal frameworks for responsible AI adoption. In 2024, Governor Jay Inslee issued Executive Order 24-01 directing agencies to develop guidance for the ethical, transparent, and accountable use of generative AI across state government. The order emphasized that agencies must balance innovation with safeguards around privacy, bias mitigation, security, and public trust. 

More recently, Washington Technology Solutions (WaTech) expanded those efforts through the state’s Artificial Intelligence Policy, which requires agencies to identify AI-enabled systems, conduct AI risk assessments and ensure human oversight remains part of decision-making processes. The policy specifically calls for governance frameworks that are transparent, auditable and aligned with Washington state’s AI Principles. 

That direction closely mirrors what many attendees at the IPMA Forum discussed throughout the event. Agencies are not simply asking how to deploy AI faster. They are asking how to operationalize AI responsibly within environments that already contain decades of sensitive records, fragmented systems and complex compliance obligations. 

This is why governance is emerging as the true foundation of AI readiness. 

Rather than treating governance as a compliance exercise that slows innovation, agencies are beginning to view governance as the foundation that enables innovation safely. When information is properly classified, secured and governed, AI becomes significantly more effective and far more trustworthy. 

Deploying Intelligent Document Automation in the Public Sector 

Early AI adoption often focused on assistance: summarizing documents, extracting data, or helping staff locate information more efficiently. Increasingly, however, agencies are shifting from simple assistance to intelligent document automation, evaluating systems capable of taking independent action within workflows. AI can now recommend next steps, identify exceptions, trigger processes, and support decision-making in real time. 

That progression raises the stakes. 

AI systems depend on context. Context depends on well-governed information. If data is fragmented, outdated, or inconsistently managed, automation compounds risk. 

That reality became evident in conversations at the IPMA Forum. Agencies are recognizing that modernization is no longer just about digitizing records. It is about creating an information environment where data can be trusted, processes can be audited and AI can operate responsibly within defined guardrails. 

Core Priorities for AI in Data Governance 

To navigate this paradigm shift safely, state and local agencies will need to map out future strategies that move away from manual oversight and toward automated workflows that embed compliance directly into daily operations. To prepare for this transition, public sector IT and business leaders should prioritize these key areas: 
  • Strategic Data Governance Frameworks: Apply consistent retention, security, and access policies dynamically across increasingly complex information environments. 
  • Foundational Workflow Automation: Create workflows to continuously classify, route, and govern information the moment it enters a system, reducing reliance on manual indexing. 
  • Secure Interoperability Standards: Design systems that enable governance policies to travel with the data itself, ensuring security rules remain completely consistent regardless of where content resides. 

And perhaps most importantly, agencies are approaching AI as a tool to augment human expertise, not replace it. 

That distinction matters. 

The most successful government AI initiatives are not removing people from the process. They are reducing repetitive work, accelerating information access, and allowing public servants to focus on higher-value decisions. Human oversight remains essential because accountability cannot be delegated to an algorithm. 

This is why responsible AI and modern content management are becoming inseparable conversations. 

Turning Trusted Information into Intelligent Action 

The agencies making the most progress are not necessarily the ones moving fastest to deploy AI. They are the ones investing in trusted information foundations first. They are aligning governance, automation and AI into a unified strategy designed to improve service delivery while protecting transparency and public confidence. 

That is ultimately the opportunity ahead of government leaders. 

AI has the potential to transform how agencies manage information, respond to citizens, and operate at scale. But the long-term value of AI will not be determined by the sophistication of technology alone. It will be determined by whether agencies can build environments where information is structured, governed and trusted enough for AI to operate responsibly. 

Washington State’s evolving AI policies make one thing increasingly clear: the future of government AI will not be defined by how aggressively agencies automate, but by how effectively they govern the information that powers those systems. 

At the Washington State IPMA Forum, that message was impossible to miss. 

The future of content management is no longer about storing information. 

It is about turning trusted information into intelligent action. 

Build Your Foundation for Responsible AI 

Successfully navigating the ongoing expansion of government AI requires an information foundation you can trust. Laserfiche helps state and local agencies bridge the gap between innovation and compliance with secure intelligent document automation and AI-driven solutions.  

See how Laserfiche accelerates secure government transformation.