Milyli AI Redaction Arrives in Blackout, but Automation Still Needs Human Review

Milyli AI redaction arrived in Blackout on October 14, adding automated recommendations for sensitive content across native Excel, PDF, and other file types. The release shifts Blackout beyond rules-based bulk processing toward language models that identify information by context. However, the central conflict remains unresolved: automation can reduce repetitive review, but missed data can still expose people and organizations.

The new system uses Azure Language through Microsoft Foundry Tools to identify personally identifiable information, privileged material, and other sensitive content. Milyli says the feature is immediately available to Blackout customers. Its value will depend on whether legal teams can verify those recommendations without recreating the manual workload that automation promises to reduce.

That tension puts Blackout between two established approaches. Traditional redaction relies on reviewers, search terms, and regular expressions. Newer AI systems classify names, identifiers, and contextual relationships that fixed rules might miss. Microsoft itself warns that automated PII detection produces both false positives and false negatives, making human oversight essential in higher-risk cases.

Blackout Now Recommends Redactions Across Native Files

The release changes how Blackout finds sensitive data, not the legal responsibility for deciding what must disappear.

According to Milyli’s launch announcement, Blackout now uses natural language processing and entity extraction to recommend redactions. The system targets PII, privileged communications, and other sensitive information across document collections.

Automatic recommendations are the most consequential part of the update. A reviewer no longer needs to know every spelling, formatting variation, or surrounding phrase before starting a search. The software can propose sensitive entities based on the language around them.

Blackout then applies those findings through its existing markup and redaction workflows. That distinction matters because detecting sensitive text and permanently removing it are separate operations. A model can identify a possible bank account number, while the redaction system controls how that content is marked, reviewed, audited, and produced.

Milyli says the release supports dozens of file formats. Native Excel receives special attention because spreadsheets present structures that ordinary document pipelines often flatten or overlook. A workbook can contain formulas, hidden sheets, comments, charts, embedded objects, headers, and partial text inside cells.

Blackout already handled those structures before the AI release. Its documented spreadsheet workflow prepares workbooks by exposing hidden content and removing recoverable change history before reviewers apply markups. It also supports cell, row, column, sheet, chart, and object redactions.

The AI layer therefore does not create native Excel redaction from nothing. It changes the identification stage by adding contextual recommendations to established spreadsheet controls. That is more precise than describing the release as a completely autonomous redaction system.

PDF workflows follow a similar pattern. Blackout can apply automated markups to searchable PDFs and manual markups to searchable or image-based files. The new AI capability expands how likely sensitive content gets identified before production.

The immediate availability also separates this release from a future roadmap announcement. Existing customers can evaluate the feature against active review collections. Milyli has not publicly disclosed adoption numbers, independent accuracy results, or customer benchmarks for the new capability.

Those missing figures limit what can be concluded on launch day. The release confirms a product change and its technical foundation. It does not yet establish how much review time the system saves in real legal matters.

Why Milyli AI Redaction Matters for Native Excel

Native Excel support turns an abstract AI feature into a test of whether automation can preserve complex evidence while removing sensitive content.

Many redaction products work most naturally on rendered pages. Spreadsheets do not behave like fixed pages. Meaning can depend on formulas, cell relationships, hidden fields, workbook tabs, comments, and objects that sit outside the visible grid.

Converting a workbook into images or PDF pages can make redaction easier to display. It can also remove interactivity, change pagination, separate formulas from values, and complicate later analysis. Native processing aims to preserve the useful structure while modifying the content that must not be disclosed.

That makes automated sensitive data protection harder than drawing black rectangles. The system must locate an entity, map it to the correct workbook element, preserve surrounding data, and create a defensible record of the action. It must also prevent removed information from remaining recoverable elsewhere.

A contact name might appear in a visible cell, a hidden row, a chart label, and a formula reference. A fixed keyword search can find exact matches, but it may miss nicknames, formatting differences, or identifiers that need context. An AI classifier can broaden detection, yet broader detection can also increase irrelevant recommendations.

Milyli’s integration with Azure Language addresses the classification problem. Microsoft’s PII detection returns entity categories, confidence scores, and redacted output. Supported categories include names, addresses, financial identifiers, government identifiers, and some health information.

Confidence scores are useful, but they are not proof that a recommendation is correct. Teams must decide which scores trigger automatic actions, which create review tasks, and which get ignored. The correct threshold varies by document type, entity category, and disclosure risk.

A low threshold can capture more possible PII and reduce false negatives. It also generates more false positives, which can conceal relevant evidence or expand the review queue. A higher threshold can reduce noise while allowing ambiguous sensitive information to pass through.

Excel makes this calibration especially difficult. A sequence of digits can represent an account number, an internal project code, or an ordinary calculation. Context from surrounding cells may resolve the meaning, but spreadsheet layouts often encode context visually instead of grammatically.

The same issue affects privileged content. Attorney names and legal terms can help identify a communication, but their presence does not automatically make every document privileged. Privilege often depends on participants, purpose, subject matter, and jurisdiction.

Blackout’s potential advantage is its connection between recommendation and markup. Legal teams can keep detection, reviewer decisions, native redaction, and audit history within one workflow. That reduces the handoffs that can introduce inconsistent rules or disconnected records.

It also puts pressure on standalone detection tools that merely return a list of entities. Enterprise buyers increasingly need an operational chain from identification through review and production. A useful model output must become a controlled document action.

The broader lesson extends beyond eDiscovery. Organizations building a local knowledge base face a related problem when sensitive technical documents enter searchable systems. Classification helps, but access controls and review policies still determine whether protected information stays protected.

Contextual AI Challenges Rules-Based Redaction

Blackout’s main opponent is not another product; it is the established belief that fixed rules are sufficient for defensible bulk redaction.

Rules-based redaction remains valuable because its behavior is relatively easy to explain. A team can search for an exact phrase, a known identifier, or a regular-expression pattern. Reviewers can document the rule and reproduce its results.

Blackout already supports bulk spreadsheet projects using terms, phrases, and regular expressions. Milyli’s documentation also permits large rule imports for image, Excel, and PDF projects. Those tools remain appropriate when teams know exactly what patterns they need to remove.

Social Security numbers illustrate the strength of rules. Their formatting follows recognizable patterns, even when spaces or hyphens vary. Credit card numbers, email addresses, and case-specific names can also work well with carefully built searches.

The weakness appears when sensitive information does not follow a stable pattern. Misspellings, inconsistent punctuation, partial names, foreign identifiers, narrative descriptions, and uncommon layouts can defeat exact matching. Rule maintenance also grows as document collections introduce new variations.

Contextual entity recognition changes the search question. Instead of asking whether a string matches a predetermined format, the system asks what role the string plays in its surrounding text. That can surface material the reviewer did not anticipate when building the rule list.

Milyli AI redaction combines those contextual recommendations with Blackout’s existing controls. This creates a hybrid model rather than a complete replacement for rules. Known patterns can remain deterministic, while the AI layer searches for less predictable instances.

That hybrid structure is likely more useful than treating AI and rules as mutually exclusive. A legal team can use rules for stable identifiers, AI for contextual discovery, and human reviewers for ambiguous decisions. Each layer addresses a different failure mode.

The approach also reflects competitive pressure inside legal technology. Relativity promotes automated redaction for data subject access requests, including AI-assisted personal data identification and an audit trail. Its broader platform also brings collection, review, redaction, and production into one environment.

The relationship between Milyli and Relativity complicates a simple company-versus-company comparison. Blackout has long operated within Relativity workflows. In September 2026, Relativity announced that Blackout would become RelativityOne Redact as a standard RelativityOne capability.

Milyli’s AI announcement therefore strengthens a workflow that overlaps with Relativity’s own AI direction. The competitive question is less about direct rivalry and more about which detection and review experience becomes the default interface for legal teams.

Other review platforms also offer automated PII detection, bulk redaction, or assisted review. Buyers will compare coverage, auditability, deployment boundaries, and native-file handling. They will also examine how easily results can be corrected before production.

Native Excel remains Milyli’s clearest differentiator within that comparison. Its redaction history predates the new AI layer, giving the company an established mechanism for modifying complex workbooks. The Azure integration now adds contextual detection to that mechanism.

Still, feature breadth alone will not settle the contest. A recommendation system that creates excessive noise can increase review costs. A conservative system that misses uncommon entities can create disclosure risk. The operational balance matters more than the AI label.

Automated Sensitive Data Protection Has an Accuracy Problem

AI can accelerate the first pass, but the costliest redaction failure is usually the sensitive item that the system never flags.

False positives are visible. They appear as unnecessary recommendations that reviewers can reject. False negatives are harder because the system presents no warning when it fails to recognize sensitive content.

That asymmetry matters in litigation, investigations, privacy requests, and regulatory productions. An unnecessary redaction can hide relevant information and require correction. A missed identifier or privileged statement can leave the organization unable to reverse a disclosure.

Microsoft’s responsible AI guidance explicitly warns against unattended high-risk redaction. It says failures can expose people to identity theft or other harm, and recommends careful human oversight.

Microsoft also notes that both false positives and false negatives occur. Confidence thresholds can change their balance, but no universal threshold solves every use case. Teams need production-like testing with their own languages, formats, and entity categories.

This caution should shape how buyers interpret Milyli’s announcement. Automated redaction recommendations do not eliminate review. They reorganize review around machine-generated candidates and exceptions.

A well-designed workflow can still save time. Reviewers can spend less effort locating obvious PII and more effort evaluating ambiguous or consequential material. Batch approval can handle recurring patterns after the team validates the system’s behavior.

However, Milyli has not published independent recall, precision, or false-negative measurements for the new release. Recall measures how much relevant sensitive content the system finds. Precision measures how many recommendations are actually relevant.

Both metrics need context. Results on clean text do not predict results on scanned documents, damaged files, unusual spreadsheets, or multilingual collections. Aggregate scores can also hide weak performance on rare but high-risk categories.

Language coverage deserves particular scrutiny. Microsoft’s capabilities and limitations differ across service versions, features, languages, and entity types. Blackout customers should verify the exact Azure configuration behind Milyli’s implementation instead of assuming uniform coverage.

Data handling creates another question. Sensitive documents must be processed before their sensitive elements can be detected. Buyers need clear answers about data location, retention, logging, encryption, access controls, and model-training policies.

Microsoft documents configuration options for secure Azure Language deployments, including controls around diagnostic storage. Milyli’s announcement emphasizes enterprise security and auditability, but it does not provide a detailed public architecture for the Blackout integration.

Privileged material introduces a separate risk. PII detection relies on recognizable entity categories. Privilege classification demands legal context and can vary by matter. A recommendation can assist a reviewer without becoming a final legal determination.

Teams should therefore distinguish three operations. Detection proposes content that deserves attention. Review determines whether the content requires protection. Redaction permanently changes the disclosed version while preserving an authorized original.

Audit logs connect those operations. A defensible system should record the recommendation, reviewer decision, rule or model involved, markup action, and final production state. That history becomes important when another party challenges the process.

NIST’s de-identification guidance reinforces the need for governance beyond technical removal. It treats de-identification as a managed process involving disclosure risks, data use, and review rather than a single software operation.

The launch announcement does not establish that Blackout removes every category of sensitive information safely in every file. It establishes a new recommendation layer backed by Azure Language. Customers must validate the resulting workflow under their own legal and security requirements.

The Real Contest Is Review Work, Not Model Branding

Milyli will succeed if Blackout reduces total review effort without weakening the control that makes redaction defensible.

AI product announcements often focus on model capability. Redaction buyers care about a wider system. They need predictable intake, accurate detection, manageable review queues, reliable markups, secure processing, and reproducible production.

A model can perform well while the overall workflow fails. Recommendations might arrive without enough context. Reviewers might struggle to approve or reverse them. Native files might preserve hidden content that the visible markup does not cover.

Blackout already addresses several downstream issues through document preparation and native markup controls. Its spreadsheet workflow can expose hidden rows, columns, and sheets before redaction. It can also remove change history that might restore protected information.

Those controls matter because visual concealment is not always genuine redaction. A black shape placed over text can leave the underlying content searchable or recoverable. Production workflows must remove or replace the protected information in the output.

The AI release adds value when it feeds the existing process without obscuring reviewer control. A recommendation should show what was detected, why it was categorized, and where it appears. Reviewers should be able to accept, reject, or refine the action.

Consistency is another possible benefit. Large matters often divide work among many reviewers, and people can interpret instructions differently. Centralized recommendation rules and thresholds can reduce variation across teams.

Yet consistency can reproduce systematic errors. If the model repeatedly misses a particular identifier, every reviewer who relies on its recommendations inherits the same blind spot. Sampling and quality control must test unflagged content, not only approved recommendations.

The strongest implementation will combine several safeguards. Teams can maintain deterministic searches for known patterns, use AI recommendations for contextual discovery, and sample documents that receive no recommendations. Escalation rules can route high-risk categories to specialized reviewers.

Customers should also compare the time saved during initial review with the time spent validating results. A faster first pass does not help if quality control expands enough to offset it. The relevant measure is total effort through final production.

Milyli has not released those operational benchmarks. It has also not disclosed how customers tune entity categories, thresholds, exclusions, or matter-specific vocabularies. Those controls will shape whether the system adapts to real collections.

Integration depth may ultimately matter more than the Azure brand. Legal teams already have access to general entity-recognition services. Blackout’s proposition is that detection belongs inside a native redaction workflow, where recommendations become auditable actions.

That position is credible because spreadsheets and productions create specialized requirements. General AI services identify text entities, but legal software must preserve chain of custody, permissions, markup history, and output integrity.

The launch therefore pressures buyers to evaluate AI redaction as a workflow rather than a checkbox. It also pressures vendors to disclose more than supported formats. Customers need evidence about detection quality, reviewer burden, security boundaries, and correction paths.

What to Watch After the Blackout AI Launch

Three signals will show whether Milyli AI redaction becomes an operational improvement or remains an appealing product claim.

The first signal is customer evidence from live matters. Milyli should publish case studies that describe collection size, file mix, review procedures, precision, recall, and total time through production. Results need enough detail for buyers to judge whether the deployment resembles their own work.

Evidence from native Excel deserves special attention. A useful evaluation should include hidden content, formulas, comments, charts, objects, unusual layouts, and partial cell redactions. Simple worksheets will not test the hardest claims behind the release.

Positive results would strengthen Milyli’s argument that contextual detection improves an established native-file workflow. Weak or narrowly framed results would suggest that the feature works best on ordinary text, where many alternatives already compete.

The second signal is the product’s control surface. Customers need to see how Blackout exposes confidence scores, category selection, exclusions, thresholds, bulk decisions, and validation samples. Clear controls would make the Azure integration adaptable to different risk tolerances.

The absence of those controls would weaken the automation case. Legal teams cannot treat every matter identically. A privacy request, internal investigation, regulatory filing, and litigation production can demand different definitions of sensitive content.

Buyers should also watch how Blackout handles model updates. A service-backed classifier can change as Microsoft releases new versions. Milyli needs a way to document versions, evaluate changes, and preserve reproducibility across long-running matters.

The third signal is how Relativity positions overlapping redaction features. Blackout’s transition into RelativityOne Redact gives the technology a large distribution path. At the same time, Relativity continues expanding its own AI-assisted privacy and review products.

A tighter integration would strengthen the argument that Milyli’s feature belongs inside the core review environment. Confusing overlaps, separate configuration systems, or duplicated recommendations would increase adoption friction.

Competitor responses will also clarify the market. Vendors can answer with better native-format support, more transparent evaluation, stronger private deployment, or lower reviewer burden. The most meaningful response will address workflow evidence rather than attach AI branding to existing search tools.

For users, the practical next step is controlled testing. Build a representative set containing known PII, privileged passages, spreadsheet edge cases, and documents with no sensitive content. Measure what the system finds, what it misses, and how long verification takes.

Milyli AI redaction deserves attention because it joins contextual detection with an established native-file workflow. It does not remove the need for reviewers, security controls, or quality assurance. Ask whether automation lowers total effort while preserving defensibility, then require evidence from documents that resemble your own.