Predictive coding is a machine learning approach that applies patterns from expert reviewer decisions to rank or classify additional documents. In legal review workflows, it helps identify likely relevant and nonrelevant material faster than manual review alone, especially when datasets contain millions of messages or files.
How Predictive Coding Works
Predictive coding uses examples from expert review to train a model that can sort new documents by likely relevance. The practical value is not that it “understands” the case, but that it learns from reviewer judgments and applies that pattern at scale, turning a vast review set into a ranked workflow rather than a purely manual one.
In litigation, investigations, and internal inquiries, this ranking helps reviewers focus first on the documents most likely to matter. That can reduce time spent on obvious nonrelevant material while preserving a defensible review method when the population is too large for line-by-line human examination.
Why Predictive Coding Is Used in Legal Review
Predictive coding is usually adopted when volume, time, and cost make traditional review inefficient. The method is especially useful where the corpus contains millions of messages or files, because it can surface probable matches early and let teams spend human effort where judgment matters most.
Its biggest advantage is prioritisation. Rather than treating every document as equally likely to be relevant, it uses the outcomes of expert decisions to create a relevance signal. That makes it a workflow control as much as a machine learning technique, because the quality of the review depends on how representative the training judgments are and how carefully the model is supervised.
What Predictive Coding Depends On
The approach is only as strong as the review decisions that seed it. If the initial examples are inconsistent, too narrow, or poorly governed, the ranking can drift away from the real issue set. In practice, predictive coding works best when teams maintain clear review criteria, consistent coding decisions, and a feedback loop that lets the model improve as more decisions are added.
It also depends on document population quality. Deduplicated, well-scoped datasets tend to produce better results than noisy collections with unrelated material mixed in. Because the method is probabilistic, it is best viewed as a prioritisation aid rather than a guarantee that every important document appears at the top immediately.
How Predictive Coding Fits into Review Governance
Predictive coding changes how organizations govern review, not just how they search. It introduces a need for clear ownership over training set selection, reviewer consistency, quality checks, and validation of the final review population. In regulated or contested matters, the defensibility of the process matters as much as the speed gain.
When used well, it supports proportionate review by making large-scale document assessment more manageable. When used poorly, it can create blind spots if teams assume the model can replace substantive legal judgment. The safest posture is to treat it as an accelerator for expert review, with human oversight preserved for thresholds, exceptions, and final calls.
Risk and Threat Considerations
Predictive coding creates risk when poor training decisions or biased review samples steer the ranking away from genuinely relevant material. In legal and investigative settings, that can lead to missed evidence, inconsistent production decisions, or an inability to defend how documents were selected.
Failure mechanism: The model learns from reviewer judgments, so errors in early coding, uneven sampling, or poor validation can propagate through the ranking and hide relevant material in lower-priority sets.
Impact: The result can be incomplete review, discovery disputes, added rework, and loss of confidence in the defensibility of the review process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV-01 — Oversight of Risk Management Strategy | Predictive coding needs oversight, validation, and accountable review governance. |
| GV.RM-01 — Risk Management Strategy | Large-scale document review creates process risk that should be managed systematically. | |
| Recommendation — Establish oversight for model training, validation, and review-quality checks. Define review-risk tolerances for sampling, validation, and defensibility. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Review workflows benefit from traceable decision logging and post-review analysis. |
| Recommendation — Log reviewer decisions and analyze exceptions to support defensibility. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | The workflow depends on recorded decisions and error visibility in automated review pipelines. |
| Recommendation — Record review decisions and monitor exceptions that affect model quality. | ||
| ISO/IEC 27001:2022 | A.5.27 — Learning from information security incidents | Review failures should feed lessons learned and process improvement where disputes or misses occur. |
| Recommendation — Capture process failures and feed them into review-procedure improvements. | ||
Practitioner Guidance
Why practitioners should care: Predictive coding is most effective when the team treats it as a governed review method, not a shortcut. The operational question is whether the training decisions actually reflect the matter scope and whether the ranking remains stable as the review progresses.
What to watch for: Reviewers should pay attention to inconsistent coding rules, unusually narrow seed sets, and model outputs that repeatedly surface the same document types while missing obvious thematic variation. Those are signs that the workflow needs recalibration rather than more volume.
Practitioner takeaway: The method earns its value when expert judgment remains in control of the process and the model is used to scale that judgment, not replace it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org