E-discovery, information governance, and AI: What counsel should prioritize now
Data sources are multiplying, tools are changing, and expectations from courts and regulators are catching up. If you advise an agency or enterprise, the path forward is simple: preserve what matters, govern data with intent, and document how you do it.
Below is a field guide you can put to work immediately.
Preservation still decides outcomes
Modern IT stacks include chat platforms with disappearing messages, auto-versioning, and AI-enabled features that create new files by the minute. These systems can overwrite or purge data before anyone realizes it had legal significance.
Counsel should actively steer preservation, not just send a hold notice and hope. Focus on scope, technical execution, and alignment across teams.
- Scope: Identify custodians, timeframes, and data types, including ephemeral content, mobile data, meeting artifacts, and AI-generated materials.
- Update templates: Refresh legal hold language and interview forms to cover new systems, prompts, logs, and AI outputs.
- Technical implementation: Coordinate with IT to pause auto-deletes, enable legal hold features, or build equivalent controls where native holds don't exist.
- Education and alignment: Train custodians to prevent self-help deletion. Align Legal, IT, HR, and Security. Obtain written confirmation that holds are in place.
New data sources, new questions
AI systems, meeting platforms, and transcription tools produce layers of artifacts. Think recordings, transcripts, summaries, attendance reports, and derivative content like podcasts generated from a meeting file. Know where each artifact lives and what varies by meeting type or host.
- Threshold assessment: Decide if the source likely contains relevant information and whether preservation and production are proportional under FRCP 26(b)(1).
- Defensibility: Standardize, document, and track chain of custody. Make the process repeatable and auditable.
- Translate legal to technical: Appoint someone who can turn legal requirements into concrete system actions for IT.
- If disproportional, show your math: Quantify burden with metrics that outweigh expected evidentiary value. Be ready to compare cost, time, and volume against likely benefits.
Mobile devices, messaging apps, and control
Requests for mobile and chat data are increasing. The tough issue: whether the organization has possession, custody, or control of that data-especially under Bring Your Own Device (BYOD) models.
- Business use: Determine if the device accesses company systems, creates unique work content (texts, chats), or is backed up to corporate platforms.
- Policy matters: A clear BYOD policy that addresses ownership, access, and employee obligations can decide control disputes.
- Standards in play: Some courts apply a legal-right test; others look at practical ability to obtain data. Know your jurisdiction's approach.
- Reality check: Don't rely on theory. Interview custodians about texting habits and third-party apps. Many organizations now use IG programs and risk metrics to gauge off-channel communications.
Information governance is your multiplier
Good IG makes discovery faster, cheaper, and more credible. It also reduces privacy and security risk. Start with these essentials and keep them current.
- Record retention schedules
- Data disposition policies and procedures
- AI policies and training
- BYOD and messaging governance
- Legal hold policies and procedures
- M&A / divestiture data playbooks
Generative AI in written discovery
Requests now define "documents" to include prompts, system and user messages, logs, settings, outputs, and AI-assisted decisions. That expands where you collect, what you review, and how you produce.
- Inventory where prompts and logs live (chat interfaces, back-end systems, API gateways).
- Decide how to preserve model versions, training data, evaluations, and testing artifacts.
- Label AI-generated content in review to avoid confusion downstream.
Protective orders and AI training
Can the other side use your production to train a private model? It depends on the protective order and related agreements. If you want to prevent this, put the restriction in writing early.
- State that produced materials cannot be used to train, fine-tune, or evaluate AI systems.
- Address derivative uses, retention periods, and deletion obligations for any AI pipelines.
- Align terms with vendor contracts and internal AI policies to avoid gaps.
Deepfakes and authenticity challenges
Courts are beginning to see alleged AI-generated evidence, with early examples such as Mendones v. Cushman Wakefield (Cal. Super. Sept. 9, 2025). Be ready to test authenticity and explain anomalies.
- Red flags: unusual metadata fields, inconsistent copyright data, off fonts, jittery video, unexpected color profiles.
- Preserve originals and system logs. Maintain a clean chain of custody.
- Use authentication principles under FRE 901 and consider expert support where needed.
Making a proportionality and burden record
Discovery volumes are surging. Courts expect specifics, not generalities. If you claim undue burden, support it with detail and offer options.
- Quantify costs: search, collection, processing, hosting, review, and re-review.
- Show volumes: source counts, file types, sizes, and expected hit rates.
- Estimate timelines: preservation to production, including QC and privilege review.
- Explain the marginal value of the requested data versus its burden.
- Propose less burdensome alternatives or narrower sampling.
Action checklist for counsel and agencies
- Map your data: collaborative platforms, meeting artifacts, mobile, and AI systems.
- Refresh legal holds and custodian interviews to include AI prompts, logs, and outputs.
- Turn off auto-delete where needed; document every preservation step.
- Tighten BYOD and off-channel messaging policies; test control in practice, not just on paper.
- Codify IG standards and review them after major IT changes or transactions.
- Address AI use in protective orders, especially model training bans.
- Prepare an authenticity playbook for potential deepfakes.
- Build a proportionality worksheet you can attach to declarations.
Where training fits
Policy without practice fails. Train custodians and IT on holds, AI data, and mobile/app usage. Re-train after tool rollouts or policy updates, and keep records of attendance and materials.
If your team needs structured AI upskilling, see curated options at Complete AI Training.
The mandate is clear: preserve intentionally, govern data with discipline, and make your process verifiable. Do that, and discovery becomes manageable-even as new systems and data types keep arriving.
Your membership also unlocks:
