FOI Star is a tool to store, track and fulfil every Freedom of Information request in your organisation — with the added power of AI finding past answers and drafting responses, and a person approving every disclosure. One system that watches the clock, does the chasing and records every approval on a concrete audit trail — every request evidenced, from receipt to publication, at a lower cost per request along the way.
Worth five minutes of your time if your FOI team lives in a shared mailbox and spreadsheets, your on-time rate is drifting, or the ICO's enforcement run against public authorities has reached your risk register. What follows: why now, how it works, what it costs — and the arithmetic of what it saves.
For IG managers and FOI leads at public organisations
Late FOIs are an enforcement risk, not just a backlog. During 2025 the ICO took formal action against at least ten NHS bodies for FOI failings — six served enforcement notices, from Dorset County Hospital in February to Cambridge University Hospitals in October 2025. Every one is public, on the regulator's own register.
Little or no tracking and monitoring: responses rarely issued in line with statutory timescales.
In other words, the regulator treats the absence of a proper tracking system as the failure itself. That is precisely the gap this product closes.
One caution from the same casebook: the trust behind that 17% had already implemented a digital FOI platform eighteen months before its enforcement notice — yet a year after go-live the backlog still stood, with no published plan to clear it. Software bought after the backlog has formed clears nothing by itself. What the ICO measures is sustained on-time delivery, evidenced month by month — which is why FOI Star pairs the case log with an ageing-backlog report your board can read.
And scrutiny, once it begins, persists: an organisation under ICO review reports to the regulator, on the regulator's timetable. The least expensive time to fix FOI tracking is before that letter arrives.
FOI Star is installed and in use at an NHS trust now, handling live requests under the same statutory clock covered above. A reference conversation with that trust can be arranged on request, so you can hear directly how it runs day to day rather than take our word for it.
Built by the team behind an HSJ Award-winning application, delivered together with an NHS trust.
Every request follows the same tracked path. AI does the heavy lifting where it helps; a person decides everything that matters. Each step is recorded.
Requests arrive through your public request form — structured at source, human-verified to keep bots and spam out, time-stamped and acknowledged automatically — with email and manual entry for everything else. No more requests scattergunned into shared inboxes.
The 20-working-day deadline starts automatically and the system never looks away: it chases contributors, nags again when nothing comes back, escalates as day 20 approaches and alerts you before the clock breaks — not after. A live ageing report shows the backlog the way your board will ask to see it. No more spreadsheet diary dates, no more chasing emails.
Before anyone lifts a finger, AI checks whether the answer is already published, or was answered, partially answered or referred in the last three years.
AI flags likely duplicates — a person decides to closeRoute to the right owner; add or transfer collaborators internally. Everything stays inside the organisation.
The system drafts a suggested response from the material gathered, and helps you apply the s.12 cost limit — logging time against the four permitted activities so your estimate is documented and defensible.
Human-approved responsesAdd whoever is part of your process — admin, IG manager, comms, as many as you need. Every approval is logged and audited, and nothing is disclosed until the chain is complete.
Send the response, optionally publish it to a searchable log so the next requester finds it first, and close the case against your retention rule.
Most FOI software records the backlog. FOI Star is built to shrink it — these four capabilities do that work.
Requesters search everything you've already published before they ask. The request form opens only after they’ve been shown what already exists — so many questions answer themselves before the clock ever starts. And when someone still needs to ask, the form captures the request cleanly and verifies a human sent it — not another email into a shared inbox.
The moment a request lands, the AI searches three years of your own history — answered, partially answered or referred — and drafts a suggested response for a person to review and approve.
FOI Star uses a local AI model that runs only inside Coreshare's UK Azure tenant (UK South) — not a public, general-purpose AI service. It is configured for FOI work and needs no training on your data, so your request content never leaves the UK boundary and is never used to train any model. Each organisation's data sits in its own isolated database.
Every open request is watched around the clock. FOI Star chases the people holding the information, nags again when nothing comes back, escalates as day 20 approaches and alerts you before a breach — not after. Nothing goes silently stale, and every reminder, contribution and approval is recorded on the audit trail.
The dashboard updates itself as requests move. No spreadsheet gymnastics at month end — the compliance position is always known, and always evidenced.
The same view exports as the board pack: on-time trend, ageing profile and duplicate-deflection savings — the sustained, month-by-month evidence the ICO's action plans demand of trusts that left it too late.
Hosted in Coreshare's UK Azure tenant (UK South), with your data processed and stored only in the UK. Coreshare is your data processor under UK GDPR Article 28 terms, set out plainly in the contract pack.
Every action — receipt, clock start, each AI suggestion, every assignment and approval, and the disclosure — is written to a tamper-evident, append-only log that no one, not even an administrator, can alter or delete after the fact. The technical basis of the log is confirmed in writing on request.
Staff use their existing organisation login, so your own MFA and security policies apply. No new passwords, no separate user list, and access ends the moment their organisation account does.
Each organisation has its own branded front end and its own separate database. Your data never shares a table, a schema or a backup with another organisation's.
The AI is shared, stateless and retains nothing — it processes each request in isolation, is never trained on your data, and only ever sees what is retrieved from your own database.
The system proposes; your team approves. A named person is accountable for every disclosure, exactly as the law expects — the AI never releases anything on its own.
Coreshare is Cyber Essentials certified and EcoVadis Silver rated, and works to the NHS Data Security and Protection Toolkit — our current DSPT position is confirmed in writing on request. It's the same sustainability assurance our top-10 pharmaceutical clients already require, and ready evidence for your social-value criteria.
FOI Star manages records and workflow, not patient care, so a DCB0129 clinical safety assessment does not apply. We confirm that position in writing — one less question for your clinical safety officer.
FOI handling is expensive in staff time long before you count the compliance risk. The figures below are illustrative and deliberately conservative — we'll model your real numbers in a benchmark call, including the clinical and senior time each request pulls in.
And those figures count only the FOI team. Most requests don't stop there: information is pulled from clinical systems by the people who run them, answers are checked by service leads, and sign-off climbs to a director — several people, on senior salaries, touching every request. The statute meters FOI effort at a notional £25 an hour; nobody who actually answers one costs £25 an hour. That distributed time is the cost no spreadsheet shows — and it is what the AI first-pass, the public disclosure log and routed approvals are built to claw back: fewer requests reaching clinical teams at all, and less senior time on the ones that do. And because FOI Star logs time against the four permitted activities as the work is scoped, your cost-limit position is established, and evidenced, before the eighteen hours are spent — not after.
Once the ICO intervenes, the bar is set for you: recent action plans require at least 90 per cent of requests answered on time — and scrutiny does not end with the first letter. One London teaching trust took fourteen months to lift compliance from 33 per cent (March 2024) to 61 per cent (May 2025) under sustained ICO scrutiny — hard-won, and still short of the bar. Reaching 90 per cent and holding it takes a system that measures it for you, week in, week out.
Five questions, scored against the ICO's published timeliness criteria and its 2025 review of NHS trusts. Your figures never leave this page — nothing is sent, stored or tracked.
If our note brought you here, it names the tier we'd suggest for you. Priced by what your organisation needs FOI Star to do — from keeping a clean operation evidenced, to seeing your true workload, to recovering a position and proving it month by month. Every tier carries the statutory clock, full casework, the audit trail — and unlimited requests: pricing is per organisation, never per request or per case. A person approves every disclosure, on every tier.
All tiers are three-year agreements, billed annually — sign for five years and the annual price drops by 7% (Track £12,040 · Understand £16,690 · Assure £23,200). The price shown is the complete software price — nothing added on top; VAT applies. Purchasing is fulfilled through our reseller partner CDW.
On every tier, as standard: your data stays in the UK — and so does the AI · the content of your requests and responses is never used to train AI models · you are the data controller — Coreshare is your processor, nothing more · remove your data, in full, at any time · DPIA assistance from day one · a person approves every disclosure · Cyber Essentials certified.
Next step: reply to the note that brought you here — we'll answer with a short mapping of your position against what FOI Star covers, the route to purchase, and the governance paperwork your colleagues will ask for. Or book 20 minutes directly: calendly.com/coreshare.
Priced and structured to fit how public bodies actually buy software — through a supplier your organisation already knows.
A predictable annual cost, bought through an established framework route and a supplier you already work with.
Risk: failure to meet the FOIA s.10 statutory deadline, leading to ICO enforcement action, an action plan requiring at least 90% on-time performance, and reputational harm. Current control: shared mailbox and spreadsheet tracking. Proposed control: dedicated deadline-aware FOI system with automated chasing and pre-breach alerting, a tamper-evident audit trail recording every approval, and board-level compliance reporting.
Bring last quarter's FOI figures to a 30-minute call. We will score your position against the ICO's own FOI self-assessment toolkit — where you stand today, where the risk sits, what an action plan would ask of you, and what the system looks like running live in an NHS trust today. You keep the scored baseline, whether or not you take this any further.
After the call we draft the material for you to adapt: a one-page board briefing, a draft risk-register entry and a costed business case built on your own request volumes and staff time.
Sources & notes. ICO review of 31 NHS trusts (82% average; 71% and 86-request backlog at large trusts): ICO, July 2025. 2025 enforcement record: six enforcement notices and further practice recommendations to NHS bodies — ICO FOI regulatory action register, correct as at July 2026. Cambridge University Hospitals NHS FT enforcement notice, 23 October 2025 (67 of 222 open requests over a year old; quarterly compliance 14–50%). Nottingham University Hospitals enforcement notice, 3 July 2025 (17% on-time in Q4 2024/25; digital platform implemented January 2024). A London teaching trust: 33% (March 2024) to 61% (May 2025) on-time, under sustained ICO scrutiny (ICO public records). 90% on-time target: ICO action plans and FOI self-assessment toolkit. Statutory deadline: Freedom of Information Act 2000, s.10. Section 12 cost limit: £450 / 18 hours for NHS bodies. Purchasing is fulfilled through our reseller partner CDW as a framework call-off. Staff-cost figures are illustrative. Prepared by Coreshare, July 2026 — confidential.