By the time a lawsuit arrives, the relevant information may already be gone.
As generative AI quietly weaves itself into the daily fabric of organizational decision-making, the law has not paused to accommodate its peculiarities — courts are treating AI-generated interactions as discoverable evidence, subject to the same preservation duties that have governed email and documents for decades. The challenge is that most AI tools were not designed with litigation in mind: they auto-delete, obscure their data in audit logs, and operate beneath the awareness of legal teams. Organizations that fail to map, govern, and preserve this new category of electronically stored information before a lawsuit arrives may find that the evidence most revealing of their decision-making is already gone — and that its absence carries its own legal consequences.
- Every prompt typed into a generative AI tool and every output it returns is now potential evidence, yet most organizations have no system in place to preserve it.
- AI platforms routinely auto-delete conversation histories or bury data in audit logs, meaning relevant information can vanish before a legal hold is ever issued.
- Courts are beginning to sanction companies for lost AI data just as they would for deleted emails — and because AI interactions reveal raw decision-making, judges may view their loss as especially prejudicial.
- Legal teams are scrambling to update hold notices, retention policies, and vendor contracts to expressly address AI-generated content before the next lawsuit exposes the gap.
- The window to act is narrow: once litigation is reasonably anticipated, organizations must immediately identify which employees used relevant AI tools, suspend auto-deletion, and coordinate with third-party vendors — steps that traditional e-discovery workflows were never built to handle.
Every day, employees ask generative AI tools to draft emails, analyze spreadsheets, and summarize documents — then close the browser tab and move on. What they rarely consider is that each of those interactions represents electronically stored information that could become critical evidence if their company ends up in litigation.
For years, legal teams have known how to freeze digital evidence when a lawsuit looms: issue holds, suspend auto-deletion, tell employees to stop deleting files. But generative AI has introduced a problem that traditional preservation practices were not built to solve. Many AI tools delete conversation histories automatically, store data only in hard-to-access audit logs, or operate entirely outside the awareness of legal and IT departments. By the time a hold goes out, the relevant data may already be gone.
The legal stakes are significant. Courts are applying standard discovery rules to AI-generated data, and failure to preserve it can trigger spoliation sanctions — monetary penalties, adverse inferences, or worse. Because AI interactions often capture the reasoning behind business decisions in ways that polished final documents do not, judges may be especially inclined to find that their loss harms the opposing party.
Addressing this requires organizations to act before litigation arrives. That means auditing which AI tools are in use, understanding what each retains and for how long, and updating retention policies to treat qualifying AI outputs as business records. Not every prompt needs to be saved — exploratory drafts that never influenced real decisions can be defensibly discarded — but the company needs a documented policy explaining why.
Once litigation becomes reasonably anticipated, the pace accelerates. Organizations must identify relevant AI users, suspend auto-deletion settings, and coordinate with vendors to preserve data before it overwrites. Standard legal hold notices are often insufficient; they must be updated to name specific AI tools, specify what to preserve — prompts, outputs, metadata, usage logs — and explain the technical steps required to actually do so.
The broader preparation involves building preservation requirements into vendor contracts before adopting new tools, training employees that AI interactions are discoverable, and updating e-discovery workflows to account for third-party-hosted AI data. As generative AI becomes more embedded in daily operations, these obligations will arise with increasing frequency. Organizations that align their AI practices with records management and legal hold processes now will be positioned to meet their duties. Those that do not will face a familiar problem: the moment a lawsuit arrives, the data they need is already gone.
Every day, thousands of employees sit down at their desks and type questions into generative AI tools. They ask ChatGPT to draft an email. They use Claude to analyze a spreadsheet. They feed proprietary documents into a vendor's platform to get a summary. Then they close the browser tab and move on. What they may not realize is that each of those interactions—the prompt they typed, the output the AI generated, the metadata logging when it happened—is now a piece of electronically stored information that could matter enormously if their company ends up in court.
For years, lawyers have understood the rules around preserving digital evidence. When litigation looms, companies must freeze their data. They issue legal holds. They tell employees to stop deleting emails. They work with IT to suspend auto-deletion routines. But generative AI has introduced a wrinkle that traditional preservation practices were not built to handle. Many AI tools do not store interaction histories by default. Some automatically delete conversations after a set period. Others preserve data only in audit logs that require deliberate configuration to access. A company's legal team may not even know which AI tools its employees are using, let alone where the data lives or how long it persists. By the time a lawsuit arrives and a legal hold goes out, the relevant information may already be gone.
The stakes are real. Courts are beginning to apply standard discovery rules to AI-generated data, treating it like any other electronically stored information. If a company fails to preserve relevant AI interactions and that loss harms the other side, a judge can order sanctions—anything from monetary penalties to adverse inferences that assume the missing data would have helped the opposing party's case. The damage can be worse if the court suspects intentional destruction. Because AI interactions often contain the raw thinking behind business decisions in ways that final documents do not, judges may be particularly inclined to find that losing this information prejudices the other side.
The solution requires organizations to think about AI preservation before litigation arrives. That means understanding the landscape: which AI tools are in use, approved or otherwise; what each tool retains and for how long; where the data actually lives; and what vendor policies govern deletion and retention. It means reviewing and updating retention policies to account for AI-generated content. Some AI outputs may qualify as business records—if an employee relied on an AI summary to make a decision, or if an AI-drafted document informed client communications, those outputs may need to be kept according to the same rules that govern other business records. But not everything needs to be saved. Exploratory prompts and draft iterations that did not influence actual decisions can be defensibly discarded, provided the company has a clear, documented policy explaining why.
When litigation becomes reasonably anticipated, the preservation obligation shifts into high gear. Companies need to quickly identify which employees used relevant AI tools, assess what deletion or overwrite settings are currently active, and work with IT and information-governance teams to suspend auto-deletion, enable logging, or preserve existing data before it vanishes. This may require coordination with third-party vendors who host the AI platforms. Traditional legal hold notices—the standard letters telling employees to stop deleting files—are often insufficient for AI data. A company needs to update those notices to expressly address the AI tools in question, specify what must be preserved (prompts, outputs, metadata, usage logs), and clarify the technical steps required to actually preserve it. If a vendor's settings continue overwriting conversation histories, telling an employee not to delete something is pointless.
The practical path forward involves several layers of preparation. Before adopting any new AI tool, companies should investigate its data retention practices and build preservation capabilities into vendor contracts. They should publish clear policies on acceptable AI use, flagging restrictions on sensitive or regulated data. They should train employees to understand that AI interactions are discoverable and may be business records. They should periodically audit which tools are in use and whether sensitive information is being retained. And they should update their legal hold templates and e-discovery workflows to account for AI-generated ESI, including data held by third-party vendors.
As generative AI becomes more embedded in daily business operations, these questions will arise more frequently in litigation and regulatory investigations. Courts will likely apply the same discovery principles to AI data that they have applied to email, documents, and other digital information for the past two decades. Organizations that understand how their AI tools create, store, and delete information—and that align those practices with their records management and legal hold processes—will be positioned to meet their preservation obligations and avoid the costly consequences of spoliation. Those that do not will face an increasingly familiar problem: the moment a lawsuit arrives, they discover that the data they need is already gone.
Citas Notables
Because GenAI ESI may reflect decision-making not apparent from final documents, courts may be more likely to find prejudice from its loss.— K&L Gates legal analysis
La Conversación del Hearth Otra perspectiva de la historia
Why does it matter so much that AI data might auto-delete? Isn't that just a technical detail?
It matters because once litigation is anticipated, you have a legal duty to preserve relevant information. If an AI tool is deleting conversations automatically and you don't know it's happening, you could lose evidence without ever intending to. A court sees that loss and may assume the missing data would have helped the other side.
But surely companies can just tell employees to stop deleting things, like they do with email?
That's the trap. With email, an employee controls the deletion. With many AI tools, the vendor controls it. You can tell an employee not to delete their ChatGPT history, but if the vendor's settings auto-delete after 30 days, the employee's promise doesn't matter. The data is gone anyway.
So what's the actual risk if data gets lost?
Sanctions. Monetary penalties, adverse inferences, sometimes even case dismissal. And courts may be harsher with AI data because it often shows the raw thinking behind decisions—the kind of thing that final documents hide. Losing it looks particularly damaging.
How far back does a company need to plan for this?
Before you even adopt an AI tool. You need to understand its retention practices, build preservation into contracts with vendors, and update your legal hold procedures. By the time litigation arrives, it's often too late.
What if a company has been using AI tools for months without thinking about any of this?
Then they need to move quickly. Audit which tools are in use, understand their settings, and update retention policies to cover AI-generated content. It's not a perfect solution, but it's better than discovering during discovery that everything is gone.