Generative artificial intelligence (GenAI) has seen a rapid expansion in personal and commercial use. Tools such as ChatGPT have helped to automate mundane tasks, create first drafts of communications and streamline research.
While the business uses for such technology are plainly attractive as potential keys to increased efficiency, companies dipping their toe in the GenAI water must weigh both the benefits and risks presented by this emerging technology. Yet, as the potential use cases and channels to access GenAI continue to multiply, the question is no longer “if” the technology will be adopted, but rather “when and how.”
For companies that utilize GenAI in their business, counsel overseeing discovery, litigation and investigations may need to consider the new types of data input into and generated from GenAI, and how that data will be treated by courts and regulators. Although many questions may not be answered yet by existing case law, regulations or court rules, we identify here some of the key issues for counsel to consider and monitor in this rapidly developing area of the law.
GenAI tools also can be hosted privately within a company’s data perimeter and can be pointed to additional sources of private data so that the responses provided by the model will be derived from, or “grounded” in, the designated data set. For example, a GenAI tool pointed to a company’s repository of policies and procedures might be able to generate summaries, comparisons or other analyses of those texts in response to user prompts.
GenAI tools can be customized to particular enterprise use cases or can be designed as more general AI assistants to individual users. AI assistants, such as Microsoft’s Copilot application, can be pointed to a user’s individual file shares, email folders and other assigned data sources and used to generate draft documents, organize email folders, summarize virtual meetings and many other tasks. These applications present obvious opportunities for increased workplace synchronization and efficiency, but companies may have to account for the new data inputs and outputs in connection with litigation and investigations.
Companies deploying GenAI may need to consider the inputs and outputs of those tools when preserving and collecting data in connection with investigations or litigation. For example, an AI assistant may keep copies of all user prompts and AI-generated outputs. In matters implicating the GenAI tools themselves, such as intellectual property disputes or investigations into discriminatory screening of employment or loan applications, discovery also may extend to the underlying algorithms and data sets used to train the GenAI model.
Courts have yet to fully weigh in on the discoverability of this information, but as with any new data type, counsel should coordinate with information technology staff to survey where potentially relevant data is stored and whether such data can be parsed to identify the inputs and outputs associated with particular custodians, groups or issues.
Third-party developers or providers of GenAI models also may hold the inputs to and outputs from those tools. Companies should consider whether contracts with these vendors adequately address data preservation and require notice of third-party discovery requests.
Finally, counsel should consider incorporating points about custodians’ use of GenAI tools into litigation hold notices, document collection surveys and outlines for witness preparation in order to cover information that may exist outside the typical repositories of enterprise data.
2. Address GenAI-related data in ESI protocols and protective orders.
Although it is not always clear that content from GenAI tools will be readily identifiable and distinguishable as such, parties wishing either to limit or explicitly require the preservation and collection of AI-related data in discovery may seek to incorporate those terms into their protocols for electronically stored information (ESI), much like parties have done for backup tapes, legacy data or other sources of data that are difficult or expensive to collect.
Similarly, companies with concerns about the security or confidentiality of data they produce in discovery may propose terms in protective orders that limit opposing counsel’s ability to use GenAI discovery tools to analyze company data productions, or alternatively require that the use of any such tools be disclosed.
3. Understand the substantive risks in litigation and investigations.
Despite the fact that GenAI models are capable of producing extremely sophisticated outputs, including achieving a 90% bar exam passage rate, they have known limitations. AI-generated content may reflect inaccuracies or biases because the model had limited or imperfect data, was trained on information reflecting historical discrimination, or was given inadequate prompts or instructions. AI models also are capable of making up facts entirely — so-called “hallucinations.”
With these limitations in mind, it is best practice for companies and their counsel to be wary in relying upon AI-generated content without verifying its accuracy and reliability.
But even when a user does not rely on AI-generated outputs, those outputs may be retained in the companies’ records, potentially making them discoverable and raising a number of issues in the course of an investigation or litigation. For example, it is unclear how courts will address authentication and admissibility of AI-generated content such as meeting notes prepared by an AI assistant rather than a human author who can attest to their accuracy and origins. Similarly, a company may be limited in its ability to rely upon the substance of AI-generated documents or, more importantly, challenge the admissibility of false information generated by AI tools.
For in-house counsel using GenAI tools in the course of their work, it is also unclear to what extent courts will extend privilege and work product protection to prompts by in-house counsel or reflecting advice or information from in-house counsel. Also, courts have yet to decide whether the outputs from GenAI tools might be afforded work product protection similar to other content drafted by or at the direction of counsel.
Companies also may face risk from an employee’s unauthorized or undisclosed use of GenAI tools, especially where the employee is a custodian or witness in an investigation or litigation. In addition, the use of AI tools may generate data that is unaccounted for in the company’s preservation, collection or broader recordkeeping efforts. Noncompliance with company policies and the risk that the confidentiality of company data may be compromised through unapproved use of GenAI also can have substantive implications in an investigation or litigation.
4. Certain uses of GenAI may waive privilege and confidentiality.
Feeding privileged or confidential information into a public GenAI model is not only inadvisable, but may breach lawyers’ ethical duties of confidentiality and may call into question later whether there was a reasonable expectation of privacy with respect to such data.
Courts look to these expectations of privacy when assessing claims of privilege in discovery. But even private vendor-hosted GenAI models can be programmed to “learn” from user prompts or other data made available to the model to “ground” its responses. These models may subsequently disclose or otherwise incorporate one client’s data in the AI-generated content provided to another client. Companies using vendor-hosted models should inquire about these capabilities and be aware that courts may decline to protect from disclosure otherwise privileged or confidential information made available to models with these ongoing learning capabilities.
It is hard to imagine an area of more rapid and transformational change than GenAI. As case law, statutes, regulations, court rules and ethical guidelines catch up, counsel should continue to learn about the technology and be vigilant in identifying ways in which its use by the business may impact discovery or other aspects of litigation and investigations.
While the business uses for such technology are plainly attractive as potential keys to increased efficiency, companies dipping their toe in the GenAI water must weigh both the benefits and risks presented by this emerging technology. Yet, as the potential use cases and channels to access GenAI continue to multiply, the question is no longer “if” the technology will be adopted, but rather “when and how.”
For companies that utilize GenAI in their business, counsel overseeing discovery, litigation and investigations may need to consider the new types of data input into and generated from GenAI, and how that data will be treated by courts and regulators. Although many questions may not be answered yet by existing case law, regulations or court rules, we identify here some of the key issues for counsel to consider and monitor in this rapidly developing area of the law.
What Is Generative AI?
GenAI is artificial intelligence capable of creating new content based on what it has learned in its training and prompts from users. GenAI tools rely on large language models (LLMs), which employ neural network models to process natural language (e.g., user prompts), and predict the best response in the form of text, images, video or audio. Generative pre-trained transformer (GPT) models are a class of LLMs that can digest massive quantities of text and infer relationships between words.GenAI tools also can be hosted privately within a company’s data perimeter and can be pointed to additional sources of private data so that the responses provided by the model will be derived from, or “grounded” in, the designated data set. For example, a GenAI tool pointed to a company’s repository of policies and procedures might be able to generate summaries, comparisons or other analyses of those texts in response to user prompts.
GenAI tools can be customized to particular enterprise use cases or can be designed as more general AI assistants to individual users. AI assistants, such as Microsoft’s Copilot application, can be pointed to a user’s individual file shares, email folders and other assigned data sources and used to generate draft documents, organize email folders, summarize virtual meetings and many other tasks. These applications present obvious opportunities for increased workplace synchronization and efficiency, but companies may have to account for the new data inputs and outputs in connection with litigation and investigations.
Key Considerations for Litigation and Investigations
1. Remember to preserve and collect GenAI-related data.Companies deploying GenAI may need to consider the inputs and outputs of those tools when preserving and collecting data in connection with investigations or litigation. For example, an AI assistant may keep copies of all user prompts and AI-generated outputs. In matters implicating the GenAI tools themselves, such as intellectual property disputes or investigations into discriminatory screening of employment or loan applications, discovery also may extend to the underlying algorithms and data sets used to train the GenAI model.
Courts have yet to fully weigh in on the discoverability of this information, but as with any new data type, counsel should coordinate with information technology staff to survey where potentially relevant data is stored and whether such data can be parsed to identify the inputs and outputs associated with particular custodians, groups or issues.
Third-party developers or providers of GenAI models also may hold the inputs to and outputs from those tools. Companies should consider whether contracts with these vendors adequately address data preservation and require notice of third-party discovery requests.
Finally, counsel should consider incorporating points about custodians’ use of GenAI tools into litigation hold notices, document collection surveys and outlines for witness preparation in order to cover information that may exist outside the typical repositories of enterprise data.
2. Address GenAI-related data in ESI protocols and protective orders.
Although it is not always clear that content from GenAI tools will be readily identifiable and distinguishable as such, parties wishing either to limit or explicitly require the preservation and collection of AI-related data in discovery may seek to incorporate those terms into their protocols for electronically stored information (ESI), much like parties have done for backup tapes, legacy data or other sources of data that are difficult or expensive to collect.
Similarly, companies with concerns about the security or confidentiality of data they produce in discovery may propose terms in protective orders that limit opposing counsel’s ability to use GenAI discovery tools to analyze company data productions, or alternatively require that the use of any such tools be disclosed.
3. Understand the substantive risks in litigation and investigations.
Despite the fact that GenAI models are capable of producing extremely sophisticated outputs, including achieving a 90% bar exam passage rate, they have known limitations. AI-generated content may reflect inaccuracies or biases because the model had limited or imperfect data, was trained on information reflecting historical discrimination, or was given inadequate prompts or instructions. AI models also are capable of making up facts entirely — so-called “hallucinations.”
With these limitations in mind, it is best practice for companies and their counsel to be wary in relying upon AI-generated content without verifying its accuracy and reliability.
But even when a user does not rely on AI-generated outputs, those outputs may be retained in the companies’ records, potentially making them discoverable and raising a number of issues in the course of an investigation or litigation. For example, it is unclear how courts will address authentication and admissibility of AI-generated content such as meeting notes prepared by an AI assistant rather than a human author who can attest to their accuracy and origins. Similarly, a company may be limited in its ability to rely upon the substance of AI-generated documents or, more importantly, challenge the admissibility of false information generated by AI tools.
For in-house counsel using GenAI tools in the course of their work, it is also unclear to what extent courts will extend privilege and work product protection to prompts by in-house counsel or reflecting advice or information from in-house counsel. Also, courts have yet to decide whether the outputs from GenAI tools might be afforded work product protection similar to other content drafted by or at the direction of counsel.
Companies also may face risk from an employee’s unauthorized or undisclosed use of GenAI tools, especially where the employee is a custodian or witness in an investigation or litigation. In addition, the use of AI tools may generate data that is unaccounted for in the company’s preservation, collection or broader recordkeeping efforts. Noncompliance with company policies and the risk that the confidentiality of company data may be compromised through unapproved use of GenAI also can have substantive implications in an investigation or litigation.
4. Certain uses of GenAI may waive privilege and confidentiality.
Feeding privileged or confidential information into a public GenAI model is not only inadvisable, but may breach lawyers’ ethical duties of confidentiality and may call into question later whether there was a reasonable expectation of privacy with respect to such data.
Courts look to these expectations of privacy when assessing claims of privilege in discovery. But even private vendor-hosted GenAI models can be programmed to “learn” from user prompts or other data made available to the model to “ground” its responses. These models may subsequently disclose or otherwise incorporate one client’s data in the AI-generated content provided to another client. Companies using vendor-hosted models should inquire about these capabilities and be aware that courts may decline to protect from disclosure otherwise privileged or confidential information made available to models with these ongoing learning capabilities.
Conclusion
Comment 8 to Model Rule of Professional Conduct 1.1 provides that lawyers “should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.”It is hard to imagine an area of more rapid and transformational change than GenAI. As case law, statutes, regulations, court rules and ethical guidelines catch up, counsel should continue to learn about the technology and be vigilant in identifying ways in which its use by the business may impact discovery or other aspects of litigation and investigations.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.