DWP Whitemail Insights and Vulnerability Scanner

The Whitemail Insights and Vulnerability Scanner is an AI tool the UK Department for Work and Pensions (DWP) runs on paper post from citizens. It reads each scanned letter and flags signs of possible vulnerability, such as suicide and self-harm or domestic violence. It sorts the letters it does not flag into routing themes, such as change of address.

How it works

The tool converts handwritten content into machine-readable text. It then uses a pre-trained, open-source language model that sorts text into categories it is given, without examples of each. The case file calls this zero-shot classification.

Each document goes to the Vulnerability Scanner first. It checks the letter against eight prescribed themes. They include suicide and self-harm, domestic violence and abuse, drugs and alcohol misuse, financial hardship, and mental health. It attaches a rationale naming the theme to each flag.

Only documents it does not flag go on to Whitemail Insights. That part sorts them into nine routing themes, such as change of address and change of bank, so they reach the right benefit lines.

Personal data is automatically redacted after scanning. The output to trained staff is an anonymised daily report of flagged customers, DWP's word for claimants, not a decision. Each scanned document carries a unique identifier. Staff can use it to find the customer's record and the original letter image, in systems separate from the two AI tools.

The system is hosted on cloud infrastructure with end-to-end encryption and no internet connectivity.

Who built it

Accenture (UK) Limited was the developer and delivery lead, working under DWP project managers. The work was part of "The Garage" partnership. PublicTechnology, a trade publication, reported that arrangement as potentially worth around £49m. DWP keeps the intellectual property.

Earlier research by Anna Dent, an independent analyst, drew on freedom-of-information requests and suspected a different supplier, Agilysis. The case file treats the attribution in the government's published transparency record for the tool as authoritative.

What DWP says it does and does not do

DWP states the tool "does not make benefit entitlement decisions or influence benefit entitlement decision-making." Staff assess each flagged situation case by case.

The Secretary of State replied to Parliament's Work and Pensions Committee on 4 December 2023. The reply committed that "any decisions that could affect the continued payment of benefits to customers are made by colleagues rather than by machines."

Richard Corbridge, DWP's Chief Digital and Information Officer, spoke to Computing, a trade publication, in March 2024. He said: "No important decision [at DWP] is made about you by any computer, it is a human that's making the decisions."

PublicTechnology described the tool as "a new and additional service" that did not replace existing manual casework processes.

How much it handles

The Secretary of State's December 2023 reply said the technology sped up finding vulnerable people among "the around 22,000 letters the department receives each day." It said the process "now takes a day rather than weeks."

In the March 2024 interview, published on 22 March, Corbridge said the tool had been live for six months. He said it was analysing 22,000 documents a day and had processed over 2 million. He said letters were sorted the day they arrived, not after weeks.

A Computing IT Leaders 100 profile of Corbridge, published on 10 June 2024, carried a further claim. It said a response used to take four to six weeks before the system went live, and that 75% now come the same day.

The transparency record, published on 27 November 2025, gives about 25,000 documents a day. These throughput and turnaround figures are claims by DWP and its ministers and officials. None has been independently verified.

How it is tested and reviewed

Testing used synthetic, real, and production-like data, with at least 15 synthetic documents for each theme. The record names three measures for judging the results: precision, recall, and F1-score. Precision measures how many of the flags are right. Recall measures how many vulnerable letters get flagged. F1-score combines the two. The record discloses no values for any of them.

After deployment, DWP reviews the outputs by hand every day. It adjusts the thresholds, the cut-off points for raising a flag, as it goes.

DWP's governance reviews included a data protection impact assessment, an Equality Analysis, a Government Internal Audit Agency review, an external assessment, and a security review. They concluded that "no key risk was identified." That is DWP's own conclusion, not an outside finding.

The 2023 correspondence with Parliament also records an AI steering board chaired by the Chief Digital and Information Officer. It records a ministerial oversight appointment, Viscount Younger of Leckie.

What critics found

Robert Booth reported in the Guardian in January 2025, using freedom-of-information requests. He found that claimants are not told the AI reads their letters. DWP's internal data protection impact assessment stated that letter writers "do not need to know about their involvement in the initiative."

The letters can include national insurance numbers, dates of birth, health information, bank details, racial and sexual characteristics, and children's details, including special needs.

The tool had been piloted since at least 2023. At the time of that reporting, it had not been logged on the central government AI transparency register, despite a ministerial mandate. The transparency record appeared roughly two years after deployment began.

Meagan Levin, policy manager at the organisation Turn2us, voiced "serious concerns." She said "transparency and accountability must be at the heart of any AI system." On the tool's core function, she said "prioritising some cases inevitably deprioritises others." She added that "it is vital to understand how these decisions are made and ensure they are fair."

Anna Dent found on 16 December 2025 that the transparency record is itself incomplete. It "refers to a section which doesn't exist." So the words or phrases DWP treats as signs of each vulnerability are still undisclosed.

Her earlier mapping, on 3 February 2025, placed this tool among DWP's other AI projects. It included two halted proofs of concept: A-cubed, which summarised policy for work coaches, and Aigent, which aimed to speed up Personal Independence Payment decisions.

The Independent reported on 27 January 2025 that at least half a dozen DWP AI prototypes had been shelved. The whitemail tool remained in use.

The error no one sees

Human oversight here is real but one-sided. A flagged letter gets a trained caseworker, who can pull the original letter image and assess the case. A letter the scanner does not flag stays in the ordinary queue. It is routed by theme and never read again for vulnerability.

Letter writers are not told the tool exists. The case file argues that a missed flag therefore brings no complaint, because no one knows there was a decision to appeal. The case file reads this as an error that surfaces, if ever, as harm blamed on something else. That reading is an inference from the documented design, not a finding.

The concern that the tool draws attention toward the flagged and away from the unflagged is voiced by Turn2us. No decommissioning, litigation, or adjudicated harm has been reported.

The case file concludes that a complaint channel cannot govern an error that produces no complaints. It names two defences: a standing second read of the letters the tool set aside, and telling letter writers there is a reading to question.

It sees the system's safety resting on one unpublished number: how often a caseworker pulls the original letter. That covers both acting on a flag and trusting that no flag means no problem.

What the design does well

The case file also credits the design. The tool is closed and encrypted, has no internet connectivity, redacts personal data after scanning, and makes no entitlement decision. So the data-leak risks that dominate other cases are low here. That leaves the unmeasured miss, and the unmeasured habit of checking the letter, as the questions that matter.

What the available tools can and cannot address

A failure pathway is a link between two parts of the network where a mistake made by one part can be passed on to the other. A pathway counts as closed once it passes on only a few mistakes. When a tool closes one, this text says mistakes stop passing along it. A network is self-correcting when its checks contain mistakes instead of letting them spread.

Six links are failure pathways at the start. Four involve the scanner: Scanner reads scanned post, Shortlist sent to caseworkers, Routing theme sent to mail staff, and Flag entered on the shortlist. The other two are Shortlist read as worklist and Ordinary queue read as worklist.

This case has a budget of 10 units. Each tool costs the same at every target level. Explore (No Targets) sets no targets.

Under Service Targets Only, the targets can be met within the budget. With no tool in use, they are not met. The cheapest ways cost 2 units and use one tool each: Escalate checks, Peer sharing rules, or Mark AI-written records. Most other combinations within the budget meet them too.

Under Service and Safety Targets, the targets also include closing every failure pathway. They can be met. The cheapest ways cost 7 units and use three tools: Escalate checks, Mark AI-written records, and either Store less data or Gate record entries.

Escalate checks closes the two pathways from the scanner to staff. Mark AI-written records closes Scanner reads scanned post and both pathways where staff read the queue. Store less data or Gate record entries closes Flag entered on the shortlist.

Under All Governance Targets, the targets can be met the same two ways, at the same cost. At both of these levels, every combination that meets the targets includes Escalate checks and Mark AI-written records. Each also includes Store less data, Gate record entries, or both.

None of the cheapest ways adds either check the case file argues for. Peer sharing rules adds the Second read of unflagged letters. Check with a second model adds the Independent accuracy check. Neither closes a failure pathway.

More checking is not always better here. Even if the budget allowed it, all ten tools at their standard settings cost 25 units, and 38 at their strongest. Either way they close every failure pathway, yet meet the targets at none of the three levels that set them. The added checks leave the scanner adding too little to the work.