Who is accountable when classified records are over-classified or never declassified on schedule?

Accountability for over-classification and for records that miss their declassification schedule is shared across several layers of an agency, rather than resting on any single person. Understanding those layers helps records and information governance professionals know where responsibility — and the remedy — actually sits.

The classifying official

The first line of accountability is the official who applies a classification marking. Under the executive-order framework that governs national security information, that person must have a defensible basis for classifying, must classify at the lowest level the information requires, and must assign a declassification instruction (a date, event, or duration). Classifying without a sound basis, or marking information at a higher level than warranted, is the core act of over-classification — and the classifier is accountable for it.

Agency leadership and program officials

Agencies are expected to designate senior officials responsible for their classification and declassification programs. These officials own the policies, training, and self-inspection that keep classification decisions defensible and keep automatic and scheduled declassification on track. When records are not reviewed or released on schedule, the breakdown is usually programmatic — insufficient review resources, unclear procedures, or backlogs — and accountability flows to the program owners, not only the original classifier.

Government-wide oversight

Above individual agencies, the Information Security Oversight Office (ISOO) at the National Archives oversees the security classification system, issues implementing guidance, and reports on agency performance, including over-classification and declassification backlogs. Inspectors general and, ultimately, Congress also exercise oversight. This external layer matters because it creates pressure and reporting requirements when agencies fall behind.

What this means in practice

• Classify accurately at the source. Over-classification is hardest to fix downstream, so the strongest control is a well-trained classifier.
• Treat declassification as a managed program, with tracked deadlines, periodic review, and self-inspection — not an afterthought.
• Document decisions. Clear rationale supports later review, oversight, and any Freedom of Information Act request.

In short, accountability is layered: the classifier for the initial decision, agency leadership for the program, and ISOO and other bodies for system-wide oversight. For more on how scheduled and automatic review work, see the declassification topic hub.