Courts are now routinely modifying standard protective orders to address AI tools in discovery. If your legal operations team hasn't updated its discovery protocols to account for these restrictions, you're exposing your organization to potential sanctions and compromising your ability to use the efficiency tools you've already purchased.
This checklist helps you assess whether your current discovery practices comply with the emerging standard for AI protective orders. Each item reflects requirements drawn from recent court orders and Federal Rule of Civil Procedure 26(c).
What This Checklist Covers
This compliance review addresses the intersection of AI tool usage and confidential discovery materials. You'll verify that your team's workflows prevent prohibited uploads, document your tool configurations, and establish clear boundaries for what "AI-assisted review" means under a protective order.
The checklist assumes you're operating under a protective order that restricts AI usage with confidential materials. If you're not yet subject to such an order, use this as a gap analysis for what's coming.
Prerequisites
Before you begin:
- You have a current protective order or draft order that mentions AI restrictions.
- You maintain an inventory of AI tools your legal team uses, including eDiscovery platforms, legal research tools, and productivity software with AI features.
- You can identify which tools are "open-source" or consumer-facing versus enterprise/closed-source.
- You know who on your team has access to confidential discovery materials.
Checklist Items
1. Identify every AI tool with access to discovery materials
List every platform where confidential documents might be uploaded, including document review platforms, legal research tools, contract analysis software, and productivity tools with AI features. Don't forget browser extensions, desktop assistants, and mobile apps.
Good looks like: A spreadsheet listing tool name, vendor, deployment type (cloud/on-premise), and whether it processes user inputs with AI.
2. Verify contractual terms prohibit model training on your data
For each tool identified above, confirm your vendor agreement explicitly states the provider will not use your data to train, improve, or develop AI systems. The prohibition in ANR Pipeline Co., LLC v. B&B Metal Processing Co., Inc. requires "enforceable contractual terms" that bar training use.
Good looks like: Contract language or vendor attestation stating: "Provider will not retain, use, disclose, sell, or use materials to train, improve, or develop any AI system."
3. Confirm data isolation from other customers
Your vendor must contractually guarantee that your discovery materials won't be accessible to other customers or made publicly available. Consumer AI platforms fail this test by design.
Good looks like: Vendor documentation confirming single-tenant architecture or logical data partitioning with access controls preventing cross-customer data exposure.
4. Document your "secure environment" configuration
Courts require AI tools operate in a secure environment with "commercially reasonable administrative, technical, and physical safeguards." Document your security controls: encryption at rest and in transit, access logging, multi-factor authentication, and network segmentation.
Good looks like: A one-page summary showing encryption standards (AES-256), authentication methods (MFA required), and audit log retention (minimum 90 days).
5. Block uploads to consumer AI platforms
Implement technical controls preventing uploads to ChatGPT, Claude, Gemini, Copilot, and similar public tools. The protective order in U.S.A. v. Amanuel explicitly prohibits "publicly accessible versions" of AI tools.
Good looks like: Network-level blocking of consumer AI domains, plus written policy prohibiting their use with discovery materials, acknowledged by all team members with discovery access.
6. Establish data deletion procedures for case conclusion
Your process must remove all discovery materials from AI tools when the case ends. The Amanuel order requires materials be "removed from the AI tool(s) at the conclusion of this case."
Good looks like: Written protocol specifying who requests deletion, how vendor confirms deletion, and where you document the deletion date. Include vendor SLA for deletion requests.
7. Create an approved-tools list
Based on items 2-4 above, publish a list of AI tools that meet protective order requirements. The Hoffman order explicitly approved Harvey, Westlaw, LexisNexis, and Servient's AI Canvas as closed-source platforms.
Good looks like: A one-page document listing approved tools, last verification date, and restrictions (e.g., "Approved for attorney review only, not for client-facing summaries").
8. Train your team on the distinction between open and closed AI
Your team must understand why they can use Westlaw's AI research assistant but not ChatGPT for the same task. The functional difference is data retention and training use, not output quality.
Good looks like: Training documentation with specific examples: "You may use [Tool X] to summarize depositions. You may NOT paste deposition excerpts into [Tool Y] even if it's faster."
9. Audit actual usage monthly
Review access logs to verify no one uploaded confidential materials to prohibited platforms. Check browser history, cloud storage upload logs, and API usage if your team uses tool integrations.
Good looks like: Monthly log review documented in a compliance file, with any violations immediately investigated and remediated.
10. Document your AI usage in privilege logs when required
If opposing counsel challenges your use of AI tools with privileged materials, you'll need to show compliance with the protective order. Keep records of which tools processed which document sets.
Good looks like: Metadata tags or case notes showing "Reviewed using [approved tool] on [date], compliant with protective order ¶[X]."
Common Mistakes
Assuming "enterprise" means "compliant." Enterprise pricing doesn't guarantee your vendor meets protective order requirements. Verify the contract terms.
Forgetting about productivity tools. Microsoft 365 Copilot, Google Workspace AI, and Grammarly all process text you input. If you're drafting briefs that quote confidential materials, those tools may violate the order.
Relying on vendor marketing claims. "We don't train on your data" in a blog post isn't an enforceable contractual term. Get it in writing in your MSA.
Next Steps
If you found gaps in items 1-5, stop using AI tools with discovery materials until you close those gaps. The risk of sanctions under Rule 26(c) outweighs the efficiency gains.
If you passed items 1-10, document your compliance in a memo to file. When opposing counsel requests your AI usage protocols (and they will), you'll have your answer ready.
Courts are establishing parameters for AI use in discovery faster than most legal ops teams are updating their procedures. This checklist gives you a defensible baseline. Now make sure your team actually follows it.
