How Windows Recall put a possible public record where no records officer could reach it

The week

On May 20, 2024, Microsoft promised Windows users a laptop with a photographic memory. Every so often it would take a picture of whatever was on the screen: an email, a spreadsheet, a web page, a chat. Weeks later a user could type “that budget chart a colleague showed me about the bridge project” and it would find the moment.

That day Microsoft announced Copilot+ PCs, a new class of Windows laptops with on-device AI features. “On-device” means the artificial intelligence runs on the laptop’s own chips rather than on a distant data center reached over the internet. The most discussed feature was Recall. It periodically saved snapshots of the screen and made them searchable in natural language, meaning you could ask for things in ordinary words rather than exact file names.

The launch took place at an event on Microsoft’s campus in Redmond, the day before its annual Build developer conference opened in Seattle. The first machines ran on Qualcomm’s Snapdragon X Elite and X Plus chips, with Intel and AMD versions promised later. Surface, Acer, ASUS, Dell, HP, Lenovo and Samsung all announced models. Microsoft said they would ship from June 18, from $999. Pre-orders opened the same day, so the feature list reached buyers and critics at once.

The defining requirement was a neural processing unit, a chip built for AI workloads, rated at more than 40 trillion operations per second. That threshold let Microsoft run language and image models locally instead of in its cloud. Recall was the showcase, alongside image generation in Paint, translated live captions and camera effects. Microsoft described Recall as a semantic index of the user’s activity, built and stored entirely on the device. From the start, users could pause it, delete snapshots and exclude chosen apps and websites.

The reaction was swift. Security researchers soon showed that preview builds, the early test versions, stored the captured data in a form that other software running as the user could read. The extracted text sat in an unencrypted database inside the user’s own profile folder, and one researcher published a free tool that pulled it out. If a piece of malicious software got onto the laptop, it could potentially read the entire archive of everything the user had seen. A feature meant to be a helpful memory looked, to critics, like a ready-made surveillance file. The UK’s data protection regulator, the Information Commissioner’s Office, said it was making enquiries with Microsoft.

The timing sharpened the criticism. In April the federal Cyber Safety Review Board had published its report on the 2023 Storm-0558 intrusion into Microsoft-hosted email, which reached accounts at federal agencies. The board sharply criticized Microsoft’s security culture. In early May, Microsoft’s chief executive had told staff that security should win whenever it competed with other priorities. Recall looked to many observers like the first public test of that pledge.

Microsoft changed course in stages. In early June it said Recall would be opt-in, meaning off unless the user chose to turn it on. It would require Windows Hello authentication, the face, fingerprint or PIN check Windows uses to confirm the person at the keyboard, and it would encrypt its data, scrambling it so it could not be read without the right key. The June 7 post added that snapshots would be decrypted only after the user authenticated, and that the search index database would itself be encrypted. Those were the specific weaknesses researchers had demonstrated. On June 13 Microsoft pulled the feature from the Copilot+ PC launch altogether and moved it to its Windows Insider program, where volunteers test features before general release. The same day, Microsoft’s president, Brad Smith, testified to the House Homeland Security Committee about the company’s security failures.

Microsoft later published a redesigned security architecture in September 2024. It moved the processing of snapshots into a walled-off area of memory called a virtualization-based security enclave, tied decryption to a biometric sign-in and made Recall removable. The return to testers slipped: an August note promised October, and an October note moved the date to December. Insiders with Snapdragon machines received it on November 22, 2024, and AMD and Intel machines followed in early December.

The public debate was about consumer privacy and hacking, and the redesign addressed it seriously. For government agencies, though, the fixes raised a question that drew less attention and carried more legal weight. If a public official’s laptop keeps a sealed, self-deleting archive of their screen, is that a public record, and if so, how would anyone find it, preserve it or hand it over?

Recall was debated as a consumer privacy and security problem, and Microsoft’s fixes addressed that debate directly. For public agencies, the fixes created a different problem. A chatbot’s history sidebar is a records system with someone else’s retention policy, but that history at least lived in a cloud service an organization could, in principle, search, hold and export. Recall’s redesigned store sits somewhere harder to reach.

The timing of that shift matters. Over the previous decade most agencies had rebuilt their records programs around central platforms. Email is captured under rules applied at the mail server. Documents live in managed libraries with retention labels. Chat is kept or deleted by policies set once for everyone. On-device AI reverses that direction of travel, because it creates new content at the edge, on the laptop, where those central rules do not reach.

Three properties of the design explain why: where the snapshots live, who can open them, and when they disappear. Each was chosen for good security reasons. Each also cuts against how public records and legal discovery work. First, though, the technology and the records duties it bumps into.

How Recall works, and what records law asks of agencies

Recall works in two steps. First, it captures images of the screen at intervals. Second, it uses AI running on the laptop to analyze those images, reading the text in them and understanding what they show, and builds an index, much like the index at the back of a book, so that the images can be searched. When a user types a question, Recall searches that index and shows the matching snapshots on a timeline.

The value to an individual is easy to see. Most knowledge workers have lost something they know they saw: a figure in a slide, a link in a chat, a sentence in a draft. Recall offers a way back to it. The risk is just as easy to see. A searchable archive of everything that appeared on a screen is, by definition, a concentrated store of sensitive material.

The mechanics that matter for records

Microsoft’s management documentation fills in the details. Snapshots are taken periodically while the content on screen differs from the previous one, so an idle screen produces few and a busy one many. Text is read with optical character recognition running locally. The results go into a vector database, a kind of index that matches meaning rather than exact words. Opening a snapshot launches Click to Do, which lets the user copy text or send images from it into other apps.

The hardware bar is high. Recall needs a Copilot+ PC meeting Microsoft’s Secured-core standard, 16 GB of memory and at least 256 GB of storage. Enabling it requires 50 GB of free space, and saving pauses when free space falls below 25 GB. Users must turn on BitLocker or Device Encryption and enroll in Windows Hello with at least one biometric option, a face or a fingerprint.

Two consequences follow for records officers. The archive is large: it is sized in tens of gigabytes, not megabytes. And its contents are images plus derived text, which means it holds whatever was on screen, including material that was never saved anywhere else.

Now the records side. Government agencies operate under public records laws, often called open records or freedom of information laws at the state level. These laws give the public a right to request records about the government’s work, subject to exemptions. Many state laws define a public record by its content and use, not its format. A note on paper, an email, a text message or a database entry can all qualify if they relate to official business.

Three levels of government, three sets of rules

Federal agencies answer to the Federal Records Act and to the National Archives and Records Administration, known as NARA. The statute defines records as recorded information made or received in the transaction of public business, regardless of form or characteristics. NARA’s General Records Schedules cover common categories, including transitory records and non-recordkeeping copies, which agencies may usually destroy once they are no longer needed. The Freedom of Information Act sets the separate duty to search for and release records on request.

State agencies usually work under schedules approved by a state archives or records commission. Counties, cities, school districts and special districts often follow general schedules the state issues for local government, sometimes with local additions. Public records statutes differ sharply in what they cover, how fast agencies must respond and what penalties apply.

Courts in several states have already decided that the device does not decide the question. In 2015 the Washington Supreme Court held in Nissen v. Pierce County that a prosecutor’s work-related text messages on a personal phone could be public records. In 2017 the California Supreme Court reached a similar conclusion in City of San Jose v. Superior Court about officials’ personal accounts. Both cases turned on the content of the communication, not on who owned the hardware.

Two other duties matter here. Agencies follow records retention schedules, approved lists that say how long each kind of record must be kept before it can be destroyed. And when an agency reasonably anticipates litigation, it must issue a litigation hold, an instruction to preserve relevant information and suspend normal deletion until the matter is resolved. E-discovery is the process of finding, collecting and producing electronic information in a lawsuit.

In federal court, Rule 37(e) of the Federal Rules of Civil Procedure governs lost electronically stored information. Since its 2015 amendment, it asks whether a party took reasonable steps to preserve it. The harshest remedies, such as instructing a jury to presume the lost material was unfavorable, require a finding of intent to deprive the other side. State courts apply their own rules, which do not always track the federal standard, so agencies should check with counsel on the rule that governs them.

Underneath all three duties is a basic principle. Records law generally makes the agency, not the individual employee, the custodian of public records. The agency must be able to find its records, keep them for the right period and produce them when the law requires. Keep that principle in mind as we walk through Recall’s design.

Where the snapshots live

Recall’s snapshots and the index built from them are stored and analyzed on the device. Microsoft’s documentation states that they are not sent to Microsoft and need no cloud connection. For privacy, that is exactly what the design intends. Data that never leaves the laptop cannot be exposed in a cloud breach.

For records management, it moves the content outside every tool an agency uses to find records. Public records searches and e-discovery collections in most agencies run against central repositories: email, document libraries, collaboration platforms, case systems. These are the places an agency’s search tools are pointed at. Endpoint collection, meaning gathering data directly from individual laptops and desktops, exists, but it is slow, forensic and usually reserved for investigations. A records request for everything an official saw about a contract award would never touch a laptop’s Recall store under normal procedures.

Why the usual collection tools come back empty

Even a forensic collection would struggle. Microsoft states that snapshots and the associated index are always encrypted, with keys protected by the laptop’s security chip and tied to the user’s Windows Hello identity. The services that decrypt them run inside the enclave, which Microsoft describes as isolated from both the operating system kernel and administrator accounts.

The architecture implies that a full disk image taken by an investigator would hold encrypted data that cannot be read without the user signing in. Microsoft has also said that snapshots cannot be restored if Windows Hello is removed or the PC is reset or replaced. There is no administrator recovery key and no central backup. For a records program, that combination is unusual: content that exists, may be relevant and cannot be reached by the agency on its own.

A copy that can outlive the original

Local storage creates a second, less obvious problem. Many agencies apply retention policies to chat and email that delete routine messages after a set period. A Recall snapshot of that chat window is a separate copy, governed by Recall’s own settings, not the agency’s chat policy.

The result can run backwards from what the records schedule intends. A conversation the central system deleted on schedule may survive for months as a snapshot on someone’s laptop. If a records request or a hold arrives while it survives, the agency may have to account for a copy it believed it had disposed of. Disposition, the controlled destruction of records at the end of their retention period, only works if every copy follows the same rule.

Whether the snapshots are records at all is a jurisdictional question, meaning the answer depends on each state’s or agency’s own law. A snapshot of a draft memo or a constituent’s case file could be a copy of a record, a transitory record (a short-lived record with little lasting value, which schedules often allow to be deleted quickly) or, in some readings, a record in its own right. Records officers and counsel need to classify it before the feature is turned on, not after a request arrives.

Three classifications and where each leads

The classification matters because each answer leads somewhere different. If snapshots are merely convenience copies of records kept properly elsewhere, the agency may be comfortable with short retention and no special search procedure. If they are transitory records, the schedule may allow quick deletion, but holds still apply. If they can be records in their own right, for example the only trace of a document someone viewed but never saved, then the agency needs a way to find, keep and produce them. Deciding which of these is true is a legal judgment, not a technical one, and it should be written down.

The kind of work done on the device shapes the answer. An analyst who mostly reads documents already held in managed libraries generates snapshots that are plausibly convenience copies. An inspector who views a vendor’s web portal, a permit officer who reads attachments in a third-party system, or an official who drafts in a browser text box may generate the only surviving trace. Many agency web applications record what was entered but not what was displayed. A classification memo that assumes every screen mirrors a managed record will be wrong for some roles.

One practical route is to classify by role rather than for the whole agency. Staff whose work runs almost entirely through managed systems can be treated one way. Roles that routinely view unmanaged or external content can be excluded from the feature, or treated as generating records that need a capture procedure. The memo should say which roles fall into which group and who decides when a role changes.

Who can open them

The redesign tied access to the individual user. Snapshots are encrypted, with keys protected by the device’s security hardware and released only after the user authenticates with Windows Hello. Microsoft’s documentation states that IT administrators cannot access or view snapshots on users’ devices. Other users of the same machine cannot either.

The details are deliberate. Recall requires a biometric sign-in to open, and the authorization times out, so the user must prove presence again in later sessions. Microsoft added rate limits and anti-hammering protections, which slow down repeated guessing, so that malware running as the user cannot simply query the store. A PIN works only as a fallback after setup.

That is a sound defense against malware and curious colleagues. A diary with a lock that only its owner can open is a good diary. It also means the agency cannot retrieve the content without the user. A departing employee, a public official under investigation or a staff member on leave holds the only key. Because records law generally makes the agency the custodian of public records, a store that only the individual can open inverts that relationship.

When the custodian has to search for the agency

Records law already has a partial answer for content that only an employee can reach. In Nissen, the Washington court accepted that an employee can search their own personal device and submit a sworn statement, in good faith, describing what they found and produced. Several agencies use similar attestations for personal phones and accounts.

The model can stretch to Recall, with limits. The employee would open the timeline, search for the terms the request covers and capture what is responsive. Quality depends entirely on the employee’s diligence and on their search terms. Under FOIA, courts ask whether an agency’s search was reasonably calculated to uncover all relevant documents. An unsupervised search by the one person whose conduct is in question will be hard to defend on that standard.

Agencies that expect to rely on attestation should write the procedure in advance. It should name who accompanies the employee during the search, what terms are used, how results are captured and logged, and what happens if the employee refuses or has left. A procedure drafted during a contested request will look improvised, because it is.

Offboarding shows the problem in practice. Agencies typically preserve a departing employee’s mailbox and files by policy, then reimage the laptop, wiping it and reinstalling a clean copy of the standard software for the next person. If Recall was enabled, reimaging destroys a store that no one else could have read. Exit procedures would need a step in which the user, before leaving, either confirms the store holds nothing of record or works with records staff to capture what it does.

Involuntary departures are harder. An employee dismissed for misconduct is unlikely to cooperate, and the laptop may be exactly where the relevant material is. Agencies with Recall enabled should decide in advance whether those devices are set aside unwiped while counsel reviews the situation. Setting a device aside costs little. Wiping it cannot be undone.

Regulated data on screen

Data protection regimes add a separate layer. Criminal justice information under the FBI’s CJIS Security Policy, federal tax information under IRS Publication 1075 and health information under HIPAA each come with handling rules, including expectations about where the data may be stored and who can be shown to have accessed it. A local, user-sealed copy of screens showing such data sits outside the audit trails those regimes expect. Recall offers app and website filters, which let administrators or users exclude certain programs and sites from capture, and a hook for data loss prevention tools, software that spots and blocks sensitive data, to exclude sensitive windows. Those filters help, but they depend on someone maintaining the lists for every system that displays regulated data.

The filters have documented gaps. Website filtering works by URL only in supported browsers: Edge, Chrome, Firefox and Opera. Other Chromium-based browsers filter private browsing but not specific sites. A filtered site is excluded only while it is the active tab in the foreground. Microsoft notes that parts of a filtered site can still appear through embedded content, browser history or other open tabs.

Data loss prevention integration is narrower than the general hook suggests. As of Microsoft’s late-2025 documentation, Microsoft Purview was the only supported provider, and it removes only the specific windows its policy flags while keeping the rest of the snapshot. A built-in sensitive information filter, on by default, skips snapshots showing items such as passwords, national ID numbers and card numbers. It looks for patterns, not for the fact that a screen belongs to a criminal history system.

Remote access offers a cleaner boundary. Microsoft filters sessions in its own Remote Desktop client, Azure Virtual Desktop and remote applications by default. Other remote clients are captured unless they use Windows’ screen capture protection flag. An agency that already delivers CJIS or tax systems through a virtual desktop can confirm that its client sets that flag, which is easier to evidence than a long list of excluded applications.

When they disappear

Recall deletes on its own schedule. Administrators can cap storage and set a maximum retention of 30 to 180 days. When the cap is reached, the oldest snapshots go first. Turning Recall off by policy deletes saved snapshots.

Retention set by disk size

The defaults are worth reading closely. If no duration policy is set, snapshots are kept until the storage allocation fills. That allocation depends on the hardware: Microsoft lists 25 GB on a 256 GB device, 75 GB on a 512 GB device and 150 GB on devices of a terabyte or more. Administrators can choose caps from 10 GB to 150 GB instead.

Without a policy, then, how long a screen archive lasts depends on the laptop’s drive and on how busy the user’s screen is. Two officials doing identical work on different models keep different histories. No records schedule would be written that way. And Microsoft notes that the storage and filtering policies apply only to the Enterprise and Education editions of Windows. Agencies running Windows Pro on some machines cannot set them there at all.

Every route to deletion

Records and legal staff should know the full list of events that destroy snapshots. They include reaching the duration limit, reaching the storage cap, an administrator disabling the Allow Recall policy, an administrator turning on the policy that stops saving snapshots, and the user deleting a range or resetting Recall. Reimaging the device, resetting Windows Hello or replacing the laptop also leave the content unrecoverable.

Each of those behaviors can collide with a litigation hold. Once an agency reasonably anticipates litigation, it must preserve relevant information, and automatic deletion of relevant material is precisely what a hold is meant to stop. An administrator who disables Recall fleet-wide in response to a records concern could, in the same action, destroy content that a hold already covered. Doing the cautious thing for one reason could create a serious problem for another.

What a hold can and cannot do

The options for preserving Recall content under a hold are limited. A hold notice can instruct custodians not to delete snapshots, reset Recall or remove Windows Hello. IT can exclude in-scope devices from any policy change while the hold runs. Neither step stops the rolling deletion as snapshots age past the duration limit or the storage cap fills.

Microsoft added a user-initiated export, but only for devices in the European Economic Area, and only where administrators allow it. Elsewhere, capturing content means the custodian finding it and saving it by other means. Each of these routes has drawbacks. The defensible position is usually the one decided before any hold: a classification that makes the snapshots copies or transitory records, a short retention that matches it, and a documented reason.

The reverse risk exists too. An agency that leaves retention at maximum keeps months of screen history it has no business purpose for, all of it potentially discoverable. Holding data “just in case” is not free. Everything kept can be requested, searched and argued over.

The practical consequence is that the enablement decision belongs with records, legal and privacy officers as much as with IT. Microsoft ships Recall disabled and removed on managed commercial devices, meaning those enrolled in an organization’s central device management system, and administrators must take deliberate steps to allow it. That default protects agencies with current device management.

Allowing it takes two separate settings. Administrators must enable the policy that makes Recall available and also disable the policy that blocks saving snapshots. Even then, the user must opt in, because administrators cannot start saving snapshots on a user’s behalf. Two policy changes and a user consent give an agency three points at which to require the records decision first.

It does not cover unmanaged devices. Microsoft’s guidance notes that Recall is available by default on unmanaged Copilot+ PCs, subject to user opt-in. Agencies that allow personal devices, or that have pockets of unmanaged hardware, have users who can create a sealed screen archive of agency work without any policy decision being made.

Microsoft’s documentation also states that there were no built-in conditional access policies for Recall on unmanaged devices. Conditional access is the set of rules an identity system uses to decide whether a given device may reach a given application. An agency cannot simply refuse sign-in from personal machines that have Recall turned on. It has to rely on broader controls, such as browser-only access, virtual desktops or blocking unmanaged devices from sensitive systems altogether.

Making the decision: who should be in the room

Because Recall touches security, privacy, records and litigation at once, no single department can make the call well on its own. A sensible process brings four perspectives together before the feature is allowed anywhere.

Records management asks what the snapshots are under the agency’s law and schedule, and how long they should be kept. If they are copies of records already kept elsewhere, a short retention may be fine. If they could be the only trace of something official, the analysis changes.

Legal counsel asks how the feature interacts with public records requests, litigation holds and discovery. Counsel will also want a clear procedure for what happens to Recall settings when a hold is issued, so that no one disables or shortens retention on a device in scope.

Privacy and compliance officers ask which regulated data might appear on screen, and whether a sealed local copy is compatible with the agency’s obligations for criminal justice, tax and health information. They will want to know who maintains the filter lists and how often they are reviewed.

IT and security explain what the settings actually do, which devices are managed and which are not, and what it would take to change the configuration later. They are also best placed to confirm that the agency’s defaults are what everyone assumes they are.

How the decision differs by type of agency

A federal agency has a designated Senior Agency Official for Records Management and an agency records officer. Its decision interacts with NARA-approved schedules and the General Records Schedules, and an unlawful destruction can trigger a report to NARA. The agency also has FOIA staff who will carry out any search. All of them belong in the room.

A state agency typically needs its state archives or records commission to agree that a new category of content fits an existing schedule. A state that has never addressed screen capture may need a schedule amendment before an agency can rely on short retention. That takes months, which argues for keeping the feature off until it is done.

A county or city usually has fewer specialists. The county attorney, a clerk responsible for records and a small IT team may be the whole group. Elected officials and appointed board members often use their own devices, which is where the unmanaged-device gap bites hardest. Law enforcement agencies, courts and anyone touching CJIS data face the strictest data handling rules and the least room for exceptions.

What the written decision should contain

The output should be a short written decision: whether the feature is allowed, for whom, with what retention, with which exclusions and under what procedure for holds and offboarding. That document is useful twice. It guides staff today, and it shows a court, auditor or records requester later that the agency thought the question through.

An auditor or opposing counsel will look for evidence beyond the memo. That means an export of the device management configuration showing the Recall policies as set, a list of devices in scope, and the hold procedure with its Recall step. It also means the offboarding checklist and a record of each annual review. Each item is cheap to produce at the time and expensive to reconstruct later.

Ask for this decision to be revisited on a schedule, perhaps annually, and whenever the vendor announces a significant change. AI features evolve quickly, and a decision built on last year’s defaults can drift out of step with how the product behaves without anyone noticing.

A planning commissioner’s new laptop

Suppose a county’s IT department manages most laptops centrally, so Recall is off on them by default. But the county’s planning commissioners use their own laptops for commission business, and one of them buys a new Copilot+ PC and turns Recall on because it seems useful.

Months later, a developer whose application was denied files a public records request for all records relating to the decision, and the county attorney anticipates a lawsuit and issues a litigation hold. The records team searches email and the document system. Nobody thinks to ask about the commissioner’s laptop, and even if they did, only the commissioner can open the Recall store. Meanwhile, the oldest snapshots continue to roll off under the retention setting. If the case reaches discovery and the opposing side learns that a searchable screen archive existed and was allowed to delete itself, the county faces awkward questions about whether it met its preservation duty.

Nobody in that sequence acts in bad faith. The problem arises because a reasonable privacy design and a reasonable personal choice landed outside the county’s records procedures. The fix is not complicated, but it has to be made in advance: a classification decision, a policy for personal devices used for public business and a step in the litigation hold process that asks about endpoint AI features.

The same sequence, prepared for

Run the scenario again with those three pieces in place. The commissioners’ device policy says that anyone using a personal laptop for commission business must keep Recall off, or must exclude the county’s systems and email client from capture. Each commissioner signs an acknowledgment once a year.

When the request arrives, the records team’s checklist includes a question to every custodian about endpoint AI features. The commissioner reports that Recall is on. The hold notice tells the commissioner not to reset or delete anything. Counsel then arranges a supervised search of the timeline, following the attestation procedure written earlier.

The outcome may still be untidy. Some snapshots may have aged out before the hold. But the county can show a policy, an acknowledgment, a prompt question and a documented search. That record is what a court weighing reasonable steps would look for.

What an agency stands to lose

Legal risk. Failing to preserve relevant information after a hold can lead to sanctions in litigation and damage an agency’s credibility in court. Failing to produce public records can lead to disputes, penalties under some state laws and public criticism.

Public trust. Open records laws exist so the public can see how decisions are made. A growing category of material that the agency cannot search or produce undermines that promise, even if no one intends it.

Regulated data. Agencies that handle criminal justice, tax or health information have contractual and legal commitments about where that data lives. A sealed local copy of screens can put those commitments at risk and complicate audits.

A pattern, not a single product. Recall is one example of a broader shift. AI features increasingly keep their own memory of what users do. Each one is a small new records question, and leaders need a repeatable way to answer them.

The strongest case for not worrying

A fair reader could push back on all of this. Recall ships off on managed devices, it requires capable new hardware, and most agencies replace laptops slowly. Snapshots are images of things that, in most cases, exist in a managed system already. Browser caches, local downloads and ordinary screenshots have always created stray copies, and records programs have not collapsed.

Much of that is right, and it argues for proportion. Few agencies need an emergency program for Recall. The argument here holds for two reasons. First, the stray copies that already exist are not indexed, searchable by meaning and retained for months by design. Second, the decision is cheap now and expensive later. Classifying the content takes a meeting and a memo. Explaining after the fact why a known archive deleted itself during a hold takes much longer.

There is also a cost to saying no. Recall can help staff with memory or attention difficulties retrieve information they would otherwise lose, and some will ask for it as an accommodation. An outright ban may be the right default, but the policy should say how exceptions are requested and how the records conditions attach to them.

A defensible position, and five ways to undermine it

A well-run agency position has three parts. Keep the allow policy disabled until records counsel has classified snapshots. Treat any future enablement as a records schedule change, with retention set to match the classification and a documented procedure for holds. Address unmanaged devices through acceptable use policy and access controls, since device policy cannot reach them.

A few simple measures show whether the position is holding. The number of Copilot+ PCs in the fleet tells the agency how exposed it could become. The number of managed devices where the allow policy is enabled should match the approved list exactly. Sign-ins to agency systems from unmanaged Windows devices show where the policy cannot see. Each can be reported quarterly from tools most agencies already run.

Agencies tend to come unstuck in five ways:

• Treating it as an IT setting. Leaving the decision to the device management team without records, legal and privacy officers at the table.
• Assuming “local” means “not a record.” Where a record is stored does not usually decide whether it is one.
• Switching it off in a hurry. Disabling the feature fleet-wide without first checking active litigation holds, when the change itself deletes snapshots.
• Forgetting personal devices. Relying on managed-device defaults while officials do public business on unmanaged hardware.
• Letting filter lists go stale. Allowing the feature with exclusions for sensitive systems, then failing to update the lists as new systems arrive.

A sixth failure is easy to miss: leaving the duration policy unset because the storage cap seems enough. That turns retention into a function of disk size and screen activity, and it cannot be defended as a records decision.

Before the first request arrives

• Has our records counsel decided whether Recall snapshots, or similar AI screen histories, are public records under our law, and in which category?
• Is the Recall allow policy disabled on all our managed devices, and who would have to approve changing that?
• Does our litigation hold procedure ask about endpoint AI features, and does it warn against reconfiguring them while a hold is active?
• Does our offboarding checklist cover any local AI archives before a laptop is reimaged?
• Which other AI tools in our environment keep their own history of what users see or do, and have we classified those too?

Agencies that can answer all five in writing have done most of the work. The remaining step is to assign one person to watch for vendor changes and bring them back to the group.

With hindsight

Recall returned to Windows Insiders in late 2024 and began rolling out to Copilot+ PCs beyond the Insider program in 2025. It was still labeled a preview, still opt-in, still encrypted and still gated by Windows Hello. Microsoft’s management documentation, updated through late 2025, confirms the properties discussed in this article. They include local storage, no administrator access to snapshots, retention limits of 30 to 180 days, removal by default on managed devices, and availability by default on unmanaged Copilot+ PCs. In the European Economic Area, Microsoft added a user-initiated export option that administrators can permit, which gives organizations there at least one route to getting content out with the user’s cooperation.

The general release came through Windows’ April 2025 optional preview update, rolled out gradually over the following weeks, with the European Economic Area following later in 2025. By then the redesign was in place: processing inside the enclave, a biometric gate, sensitive information filtering on by default and the ability to remove Recall entirely.

The hardware base widened at the same time. Intel and AMD Copilot+ PCs reached the market during the second half of 2024, so Recall-capable machines stopped being a Qualcomm niche. An agency buying ordinary business laptops in a normal refresh cycle could acquire the capability without seeking it, which turned the records question from theoretical to live for any agency whose fleet included them.

Software makers also responded. In May 2025 the Signal messaging app began blocking screen capture of its Windows client by default, citing Recall, using the same flag Windows offers any developer. Other privacy-focused applications took similar steps. That shifted part of the control to individual applications, which helps where a vendor acts and does nothing where it does not. Agency line-of-business systems built before Recall existed had no reason to set the flag, and many will not set it unless someone asks.

Microsoft’s enterprise controls grew more detailed. By late 2025 its documentation described integration with Purview data loss prevention at the window level, default filtering of several remote desktop clients and the EEA export policy. It also stated plainly that storage and filtering policies applied only to Enterprise and Education editions, and that there were no built-in conditional access controls for Recall on unmanaged devices. Each of those details bears on a records decision, and each changed after the original announcement.

The redesign largely settled the security argument that followed the launch. The records question did not go away, because the same pattern spread. More endpoint and productivity AI features now retain user content by default in places central records tools were not designed to search. Each one, taken alone, can look like a small product setting. Together they amount to a steady drift of potentially official material away from the systems agencies use to meet their legal duties.

Agencies that classified the content and set retention before enabling features were in a position to answer requests and holds. Those that relied on vendor defaults depended on those defaults staying the same, and defaults change with product updates, licensing tiers and regional rules, as the European export option shows.

What held up from the original analysis is the structural point: local storage, user-only keys and self-expiry were permanent design choices, not launch-week accidents. What changed was the amount of administrative control around them, which grew steadily but never reached the content itself. No administrator setting lets an agency read a user’s snapshots, and Microsoft has presented that as a principle rather than a gap.

AI features with memory are records decisions as well as technology decisions. The questions are old ones: what is this, how long do we keep it, who can find it, and how do we stop it being deleted when the law says it must be kept. What has changed is where the answers need to be applied. A short standing process that brings records, legal, privacy and IT together whenever a new feature stores user content will serve an agency better than a scramble after the first request or subpoena arrives.