Scope - What This Guide Covers
This guide focuses on managing AI-generated content in your organization for records management and legal discovery. It applies to:
- Chat logs from AI assistants (ChatGPT, Claude, Copilot, etc.)
- AI-generated meeting transcripts and summaries
- Prompts, outputs, and conversation histories stored by AI platforms
- Any AI tool output documenting business decisions or communications
This guide does not cover AI model training data, algorithm documentation, or IT system logs.
Key Concepts and Definitions
AI-Generated Record: Any prompt, output, chat log, or transcript created through interaction with an AI platform that documents business activity, decisions, or communications.
Recordness: The quality that makes an AI output a record subject to your Records Control Schedule. An AI chat becomes a record when it documents a business decision, transaction, or communication with evidentiary value.
Record Declaration: The act of formally designating an AI output as a record subject to retention requirements. Without declaration, AI outputs may be deleted by platform auto-deletion policies before you can assess their retention requirements.
Legal Hold: A directive to suspend normal disposition for records relevant to anticipated or active litigation. Your AI platforms must support Legal Hold overrides, or you'll face spoliation risk.
Requirements Breakdown
Discovery Obligations
AI chat logs, prompts, and automated transcripts are discoverable business records. Courts have held that retained AI conversation histories constitute evidence subject to normal discovery rules. In Fortis Advisors LLC v. Krafton, Inc., the court relied extensively on AI chat logs to determine that a CEO's stated reasons for terminating employees were pretextual. The logs weren't dismissed as informal brainstorming; they became key evidence.
Your obligation: Treat AI outputs with the same discovery-readiness standards you apply to email and instant messages.
Privilege Limitations
Attorney-Client Privilege: Does not apply to AI tool conversations. Multiple courts have held that AI platforms are not attorneys and conversations with them lack the confidentiality required for privilege. Even if an employee asks an AI tool for legal advice, that conversation is not protected.
Work Product Doctrine: Application varies by jurisdiction and depends heavily on state privacy policies:
- Delaware approach: AI records generated in ordinary business course are not protected, regardless of timing.
- Michigan approach: Doctrine may apply if records were generated in anticipation of litigation and the AI platform is treated as a tool (not a third party).
- New York approach: Doctrine does not apply when the AI platform's privacy policy discloses that prompts may be shared with third parties or used for model training.
Your obligation: Do not assume privilege protections for AI-generated content. If you're using AI for litigation preparation, verify your jurisdiction's stance and review the platform's privacy policies.
Retention and Disposition
AI platforms often apply their own retention rules:
- Some retain all conversation histories indefinitely
- Others auto-delete after 30, 60, or 90 days
- Some allow user-controlled deletion
These platform defaults don't align with your Records Control Schedule. An AI chat documenting a business decision may have a 7-year retention requirement, but the platform deletes it after 30 days. Conversely, casual brainstorming may be retained indefinitely when it should be treated as a transitory record.
Your obligation: Map AI outputs to your existing Records Control Schedule based on business function, not platform defaults.
Implementation Guidance
Step 1: Map Current AI Usage
Conduct a survey across departments to identify:
- Which AI platforms employees use (sanctioned and unsanctioned)
- What business functions they support (decision support, drafting, meeting transcription, research)
- Where outputs are stored (platform cloud, local downloads, integrated systems)
- What retention and deletion policies the platforms enforce
Document this in a register that links each AI tool to the business processes it supports.
Step 2: Classify AI Outputs by Function
Apply your Business Classification Scheme to AI records based on what they document, not the tool that created them:
- Executive decisions: Map to corporate governance records series
- Meeting transcripts: Map to meeting records series for the relevant body
- Contract drafting assistance: Map to contract development records
- Casual brainstorming with no decisions: Treat as transitory, non-record
Don't create a separate "AI Records" category. AI is a creation method, not a business function.
Step 3: Implement Record Declaration Procedures
For AI platforms that allow conversation export:
- Train users to export and declare records when a chat documents a decision or transaction
- Integrate export workflows with your records repository
- Set calendar reminders for periodic review of retained conversations
For AI platforms with auto-delete:
- Configure the longest available retention period
- Establish weekly or monthly review cycles before auto-deletion occurs
- Escalate to IT if the platform cannot support your retention requirements
Step 4: Address Legal Hold Procedures
Your Legal Hold process must account for AI records:
- Identify custodians' AI platform accounts (including personal accounts used for work)
- Issue platform-specific hold instructions (most AI tools don't have native hold functions)
- Require custodians to export and preserve relevant conversations
- Document the preservation method in your hold file
Step 5: Train Employees
Your training must cover:
- That AI chat logs are business records subject to discovery
- That attorney-client privilege does not apply to AI conversations
- How to identify when an AI output is a record requiring declaration
- Platform-specific export and deletion procedures
- The consequences of inappropriate deletion (spoliation sanctions)
Deliver this training annually and when onboarding new AI tools.
Common Pitfalls
Assuming informality protects you: Courts treat AI chat logs as evidence, not casual notes. The tone of the conversation doesn't determine discoverability.
Relying on privilege for sensitive AI conversations: If you're using AI to explore legal strategies, those conversations are discoverable. Use human attorneys for privileged communications.
Ignoring platform privacy policies: If your AI platform's terms allow prompt sharing or model training with your data, you've disclosed to third parties. That disclosure can defeat work product protection and create confidentiality risks.
Treating all AI outputs as records: Not every AI interaction is a record. A chat exploring "what if" scenarios with no resulting decision is transitory. Over-retention creates discovery burden.
Waiting for litigation to address AI records: Implementing retention mapping and hold procedures after you receive a preservation notice looks like spoliation. Build the framework now.
Allowing unrestricted auto-deletion: Platform defaults that delete after 30 days may destroy records with longer retention requirements. You can't comply with a Records Control Schedule if the platform deletes first.
Quick Reference Table
| AI Output Type | Likely Classification | Retention Trigger | Hold Considerations |
|---|---|---|---|
| Chat log documenting business decision | Record | Event-Based Retention from decision date | Custodian must export and preserve; platform hold insufficient |
| AI-generated meeting transcript | Record | Cutoff at meeting date; retain per meeting body schedule | Verify transcript accuracy before declaring as record |
| Exploratory prompts with no decision | Transitory non-record | Delete when no longer needed | No hold required unless directly relevant to claims |
| Contract drafting assistance | Record if final draft incorporates AI output | Cutoff when contract executed | Preserve prompts showing decision rationale |
| AI legal research summary | Discoverable (not privileged) | Retain per research file schedule | Cannot claim privilege; treat as consultant work |
Critical takeaway: The question isn't whether your AI records will appear in litigation. It's whether you'll have defensible procedures in place when they do.
