Skip to main content
Records Authority
Category: Systems and Technology

Robotic Process Automation

Also known as: RPA, software robots, bots
Simply put

Robotic Process Automation (RPA) refers to software tools that carry out repetitive, rule-based tasks that people would otherwise perform manually, such as entering data or moving information between systems. The software acts as a kind of digital worker, following defined steps to complete routine work. It is typically applied to activities that are predictable and structured rather than those requiring human judgment.

Formal definition

Robotic Process Automation (RPA) is a form of business process automation technology in which software robots, sometimes combined with artificial intelligence capabilities, partially or fully automate manual, rule-based, and repetitive human activities. Typical applications include data entry, data transfer, and system integration tasks, where the software emulates the actions a human user would take across applications and interfaces. In a recordkeeping context, RPA may participate in activities such as the capture, classification, or routing of information; however, its use does not by itself guarantee that outputs meet the authenticity, reliability, integrity, and usability requirements of an authoritative record, which depend on how the automation is designed, controlled, and governed. The scope of RPA as described here is limited to the automation of defined tasks and does not extend to broader information governance, records management, or decision-making frameworks.

Why it matters

For records and information governance professionals, RPA is significant because it increasingly participates in the very activities that shape the record: capturing information, classifying it, moving it between systems, and routing it for action. When software rather than a person performs these steps, questions of accountability, control, and evidential quality do not disappear; they shift to how the automation is designed and governed. An output produced by a software robot is not automatically an authoritative record. Whether it satisfies the properties typically expected of a record, such as authenticity, reliability, integrity, and usability, depends on the controls surrounding the automation rather than on the mere fact that a task was automated.

RPA can offer benefits for recordkeeping when it is applied to predictable, rule-based work, since consistent execution of defined steps may reduce certain kinds of manual error and support more uniform capture or classification. At the same time, automation can propagate mistakes at scale if the underlying rules are flawed, if source data is poor, or if the process is changed without corresponding updates to controls and documentation. Because RPA typically emulates the actions a human user would take across existing applications and interfaces, it may be sensitive to changes in those systems, which is a consideration for the ongoing reliability and integrity of what it produces.

A further consideration is that RPA, as scoped here, automates defined tasks and does not itself constitute an information governance or records management framework. Organizations that treat the deployment of software robots as a substitute for policy, retention, disposition, and oversight risk creating processes whose outputs are difficult to trust or account for. Depending on organizational policy and applicable requirements, the actions of RPA may also need to be documented, auditable, and subject to the same governance expectations as equivalent human activity.

Who it's relevant to

Records managers
Records managers may encounter RPA where software robots perform capture, classification, or routing that would otherwise be done manually. Their concern is typically whether the automated outputs can serve as reliable records, which depends on how the process is designed and controlled rather than on automation alone. They may need to ensure that automated recordkeeping actions are documented and consistent with retention and disposition requirements.
Information governance officers
Because RPA automates defined tasks but does not itself provide a governance framework, information governance officers are relevant to ensuring that automated processes sit within appropriate policy, risk, and oversight structures. They may need to confirm that the deployment of software robots does not create gaps in accountability, and that automation supports rather than bypasses established controls.
Compliance and audit leads
Compliance and audit professionals have an interest in whether the actions performed by software robots are controlled, documented, and auditable to the same standard as equivalent human activity. Depending on organizational policy and applicable requirements, they may need assurance that automated processing preserves the integrity of information and can be evidenced when reviewed.
IT and process automation teams
Teams that design and maintain RPA are relevant because the reliability of outputs depends on how the automation is built and how it responds to changes in the underlying systems it emulates. They carry responsibility for ensuring that rules, exception handling, and change management support, rather than undermine, the recordkeeping and governance expectations placed on the process.

Inside RPA

Software robots (bots)
Configured software agents that execute rule-based, repetitive tasks by interacting with applications and interfaces in a manner that emulates human actions. In a recordkeeping context, bots may create, capture, move, or update records and their metadata.
Rule-based process logic
The predefined instructions and decision paths that govern how a bot behaves. Because RPA typically operates on deterministic rules rather than independent judgment, its outputs are only as reliable as the logic configured for it.
Attended and unattended automation
Attended automation runs alongside a human operator and is triggered by user activity, while unattended automation runs autonomously, often on a schedule or in response to system events. The distinction affects where human oversight and accountability sit in a records process.
Audit logs and activity trails
Records of the actions a bot performs, which can support the traceability of automated recordkeeping activities such as classification, capture, or disposition. Depending on organizational policy, these logs may themselves need to be managed as records.
Integration points
The connections between RPA and the underlying systems it operates, such as recordkeeping systems, line-of-business applications, or repositories. RPA often works at the user-interface layer rather than through formal system integration, which can affect the integrity of resulting records.
Governance and configuration controls
The policies, access permissions, change management, and human accountability that surround an RPA deployment. These controls determine whether automated actions on records remain authorized, documented, and reversible.

Common questions

Answers to the questions practitioners most commonly ask about RPA.

Is Robotic Process Automation the same as artificial intelligence or machine learning?
No. Robotic Process Automation typically refers to software configured to execute rule-based, repetitive tasks by mimicking the actions a user would take across applications, such as moving data between systems or populating fields. It generally follows predefined logic rather than learning from data or making probabilistic decisions. Some implementations are combined with AI or machine learning components to handle unstructured inputs or decision support, but RPA in its basic form is deterministic and rule-driven. Professionals should distinguish the automation of a defined workflow from cognitive capabilities, which are not inherent to RPA itself.
Does deploying RPA mean an organization no longer needs records management controls over the affected processes?
No. Automating a process does not remove recordkeeping obligations, and it may introduce new ones. When RPA performs actions that create, capture, move, or dispose of records, those activities typically still need to be governed by classification, retention, and disposition rules, and the resulting records still need to satisfy properties such as authenticity, reliability, integrity, and usability. In many cases the automation itself generates evidence of activity that may need to be captured and retained. RPA changes how a process is executed; it does not, on its own, discharge records management responsibilities.
How should the actions performed by an RPA process be documented so they remain defensible?
Organizations often maintain documentation of the configured logic, the systems and data the automation touches, and the business rules it applies, so that the behavior of the process can be understood and explained after the fact. Where the automation creates or alters records, capturing logs of what actions were taken, when, and under whose authorization can support the integrity and authenticity of the resulting records. The appropriate level of documentation typically depends on organizational policy and the risk, regulatory, and evidential requirements applicable to the process.
What records or evidence does an RPA deployment itself typically generate?
RPA deployments often produce execution logs, exception and error records, and audit trails showing the actions performed by the automated process. Depending on organizational policy and any applicable regulatory or evidential requirements, some of these outputs may themselves constitute records of activity that need to be captured and retained, while others may be transitory. Determining which outputs are records, and for how long they should be kept, generally involves applying the organization's classification and retention framework rather than treating all system logs uniformly.
How can retention and disposition rules be enforced when a process is automated?
Because RPA can create, move, or delete content at scale and speed, it is generally important to ensure the automation operates within, rather than around, the organization's retention and disposition rules. This often involves confirming that automated actions do not delete or transfer records prematurely, that disposition is not mistaken for destruction where transfer or permanent preservation is required, and that any deletions are authorized and recorded. Aligning the automation's logic with the applicable retention schedule and disposition authorities, and testing that alignment, is typically part of responsible implementation.
What governance considerations arise when RPA touches records subject to legal holds or privacy obligations?
Where automated processes act on records that may be subject to legal holds, statutory retention periods, or privacy obligations, care is generally needed to ensure the automation does not alter or destroy content that must be preserved or protected. Such requirements differ across jurisdictions and sectors, so the controls applied typically depend on the applicable regime and organizational policy. It is often advisable to be able to suspend or constrain automated disposition when a hold is in place and to account for how the automation handles personal or otherwise regulated information.

Common misconceptions

RPA is a form of artificial intelligence that can exercise judgment over records.
RPA as commonly deployed is typically rule-based and deterministic, executing predefined steps rather than making independent decisions. It may be combined with AI capabilities in some implementations, but the automation itself does not inherently confer judgment, and outputs depend on the logic configured for it.
Automating a task with RPA guarantees that the resulting records are authentic and reliable.
Automation does not by itself establish the properties that make something a trustworthy record, such as authenticity, reliability, integrity, and usability. These depend on how the bot is configured, controlled, and audited. Poorly governed automation can propagate errors or create records whose integrity is difficult to demonstrate.
RPA removes the need for human accountability in recordkeeping processes.
Responsibility for records typically remains with the organization and its designated roles regardless of automation. RPA shifts execution rather than accountability, and oversight, change management, and audit remain necessary to defend automated actions on records.

Best practices

Document the rule-based logic and decision paths of each bot so that automated actions affecting records can be understood, reviewed, and reproduced.
Retain and manage audit logs of bot activity to support traceability, and determine, according to organizational policy, whether those logs should themselves be treated as records.
Apply access controls, change management, and human oversight to RPA configurations so that automated actions on records remain authorized and accountable.
Assess whether automated processes preserve the authenticity, reliability, integrity, and usability of the records they create, capture, or move before relying on the automation in production.
Distinguish attended from unattended automation when assigning oversight, ensuring that autonomous processes have appropriate monitoring and exception handling.
Review integration points to confirm that bots operating at the user-interface layer do not compromise record integrity or metadata captured in underlying systems.