Why did Minnesota import a copyright-style authorship test into a strict-liability tort?

TL;DR Minnesota sought to ban nudification sites and apps by aiming its sights at the tool, rather than the holder of the salacious and AI-modified images. These nudification apps allow users to take a photo of real person, and instantly make it into a nude, sexualized image, with a couple of clicks. The problem with Minnesota’s statute is that it exempts tools that require a high level of skill to use. Thus, the validity of the statute appears to rest in the delicate balance of an undefined level of skill needed.

Minnesota’s ban on nudification technology, Minn. Stat. § 325E.91 (H.F. 1606), took effect August 1, 2026. Minnesota appears to be the first state to enact a stand-alone ban targeting access to nudification technology itself; the tool that creates naked pictures rather than the actual images that the tool can create. It’s a fabulous idea. It’s going for the heart of the problem.

The coverage I’ve seen has centered on two things:

1. the near-unanimous vote (132-1 in the House, 65-0 in the Senate), and

2. xAI’s First Amendment challenge, filed July 27 in the District of Minnesota, in which Judge Donovan W. Frank denied a TRO on July 31 on timing rather than the merits, with a preliminary injunction hearing set for August 19.

The first is great, and not surprising. The second is disappointing (the lawsuit, not the denial of the TRO), and also not surprising.

But these just center on Subdivision 2 — the prohibition. Neither is about Subdivision 3, which is my problem with this statute.

The Statute

Subdivision 2 provides that a person who owns or controls a website, application, software, program, or other service must not (1) allow a user to access, download, or use it to nudify an image or video, or (2) nudify an image or video on behalf of a user. Subdivision 2(b) separately bars advertising or promoting any such service.

There is no scienter requirement. There is no consent element. Section 325E.91 contains neither a lack-of-consent element nor an express consent defense; an otherwise covered use therefore appears covered even if the depicted individual consented. The operative violation is the provider’s allowing access, download, or use of a covered service to nudify, or nudifying on a user’s behalf; distribution is not an element. That part I love. There is no good-faith safe harbor for providers that prohibit nudification in their terms, deploy input and output classifiers, or maintain functioning trust-and-safety programs. Enforcement runs through the Attorney General under Minn. Stat. § 8.31, with a civil penalty of up to $500,000 per unlawful access, download, or use, plus a private action under Subdivision 4 for compensatory damages, including mental anguish or suffering, up to three times actual damages, injunctive relief, and fees. That’s a huge deterrent.

“Intimate part” is not defined in the statute. It is imported by cross-reference from Minn. Stat. § 609.341, subd. 5 — the criminal sexual conduct definitions — which reaches “the primary genital area, groin, inner thigh, buttocks, or breast of a human being.” That definition is apparently what xAI based their overbreadth argument on, since inner thighs and buttocks appear in swimwear photographs and men’s chests appear whenever a shirt comes off. xAI LLC. v. Ellison, No. 0:26-cv-03425 (D. Minn. filed July 27, 2026). I’ll look into that in a different article.

Then, the part I hate — Subdivision 3:

Exemption. The prohibitions in subdivision 2 do not apply when the website, application, software, program, or other service requires the technical skill of a user to nudify an image or video.

And Subdivision 1(e):

“Technical skill” means substantial application of individualized technological or artistic skill and judgment by a human creator in directing, shaping, or controlling the output.

Nudification Is Ok If Technical Skill Is Required

This law screams that it’s ok to take a clothed picture of a real person, and without their consent use it to create a naked, sexualized, salacious image, so long as it’s not easy to do. Essentially, Minnesota has enacted a Photoshop carve-out. Using Photoshop well takes skill; I know, because I’ve used it for over a decade, and am still not good at it. It’s a professional compositing tool that demands hours of masking, layering, Gaussian blur and using various tool and manual judgment. None of this seems to fall within the prohibition. A one-click “remove clothing” app or feature does. The distinguishing variable is not the harm, not the consent, not the distribution, and not the resulting image. It is how much work the user had to do.

Wait, what? That is a genuinely novel move in tort drafting. Essentially, Minnesota has taken the human-authorship inquiry from copyright law and repurposed it as a liability trigger — but with the polarity reversed.

Compare the Copyright Office’s Part 2 report on copyrightability (Jan. 29, 2025), which concluded that generative outputs are protectable only where a human has determined sufficient expressive elements, and that prompts alone do not supply enough control. The D.C. Circuit’s decision in Thaler v. Perlmutter reaffirmed the human-authorship requirement where the application named an AI system as the sole author. The operative concept in both is degree of human control over the expressive result.

Subdivision 1(e) is that same concept — “individualized technological or artistic skill and judgment by a human creator in directing, shaping, or controlling the output.” In copyright, sufficient human control earns you rights. In § 325E.91, sufficient human control earns the provider immunity. The less the human contributes, the more the provider is at risk.

There is a coherent theory underneath this. The legislature is targeting frictionlessness — ease, speed, and scale. What this says to me is that mass-scale, no-skill, no-cost victimization of classmates and ex-partners is a different social problem than a skilled forger with a graphics tablet, even if the output looks the same. I get it. Regulating friction is a defensible policy instinct. But that defensibility doesn’t overcome the horrifying reality that legality comes down to how easy a non-consensual nudified pic was to create.

The “Technical Skill” Exemption Doesn’t Work

However, I see several drafting problems with it, which I address in the following section. But first, my take is that the Exemption that was meant to save the statute will backfire.

xAI’s last-minute lawsuit to stop enforcement of this law provided swimsuit-and-satire hypotheticals in support of its overbreadth arguments. Minnesota can answer with Subdivision 3: the statute does not reach typical creative tools, because those tools require real skill. And now Minnesota can maintain there is no facial overbreadth challenge.

But the same provision creates an under-inclusiveness problem. The statute’s apparent purpose is to address nonconsensual sexualized deepfakes, but its operative definition reaches realistic added ‘intimate parts’ without requiring sexual intent, lack of consent, or dissemination. An exemption that permits the identical image, of the identical victim, causing the identical harm, so long as the perpetrator used a more technical tool, does not accomplish what I imagine Minnesota wanted to accomplish. Plus, underinclusiveness has caused problems before — Brown v. Entertainment Merchants Ass’n, 564 U.S. 786 (2011), and Reed v. Town of Gilbert, 576 U.S. 155 (2015).

The state’s strongest framing is that Subdivision 3 is not a content exemption at all but a means-and-scale distinction. The legislature targeted the industrialized, ‘one click’ version of the conduct because that is the version producing harm at volume. Whether that survives strict scrutiny — assuming a court applies it, which it likely will to a nudity-defined restriction — is an open question with no direct precedent. We’re waiting on the August 19 hearing for that.

Why I Hate Minnesota’s Statute

Not the ambition. Not the goal. And not entirely the means. I genuinely appreciate what the statute is trying to accomplish. I am no advocate of pornography. And going after the tool instead of the image is smart, and the 132-1 vote reflects a legislature that understood the harm. They just apparently didn’t understand how to fix it. And so for them, I (as an amateur and not a true Constitutional scholar) note these problems with the Statute:

1. Compliance Requires 100% Success

Despite its good intentions, § 325E.91 inverts the usual trust-and-safety incentive structure. Typically, a provider would reduce exposure by putting into place policy prohibitions, classifiers, refusal training, red-teaming, abuse reporting, and rate limiting. Under this statute, none of that matters. There is no reasonable-efforts defense, no notice-and-takedown pathway, no scienter element to negate. A provider that blocks 99.9% of nudification attempts is liable for the remaining 0.1% on identical terms as a purpose-built nudify site.

By making skill the determining factor, the statute rewards making the product harder to use. That is an odd thing for a consumer protection provision to incentivize. xAI has told the court it would have to strip back image-editing features for Minnesota users. That is the statute working as drafted, and maybe some users will decline to create naked pictures if they can’t do it in one simple click. But it leaves a gigantic range of possibilities for sexually modifying a picture of a real person.

2. The Exemption Is Aimed At The Service Level, Not The Individual Level.

The text asks whether the service “requires the technical skill of a user.” It does not ask whether the particular user, in the particular instance, actually applied any technical skill. That question goes to product architecture, not a fact question about a defendant’s conduct.

The consequences run in both directions. A professional-grade editing suite appears categorically exempt — including when a determined user employs it to produce exactly the image the statute exists to prevent. A general-purpose model with a natural-language editing interface appears categorically covered — including when a user spends two hours iterating with detailed artistic direction, which is precisely the “substantial application of individualized technological or artistic skill and judgment” the definition describes.

The definition and the exemption are, in other words, pointed in different directions. Subdivision 1(e) describes what a person does. Subdivision 3 asks what a service requires. A court could reconcile them either way, and the reconciliation determines whether a large multimodal provider falls inside the statute, or not.

3. How Much Skill Is Enough? “Requires” Has No Measurement.

Does a service “require” technical skill if its default path is one click but its advanced path demands manual masking? Nearly every serious image tool now includes both an easy AI path, and a more difficult, technical one. My last use of Photoshop was all AI-driven. I could have stumbled my way through masking, and dodging and whatever, but there was a simple button that allowed

If the answer is that any available low-skill path in a tool defeats the exemption, then the exemption reaches almost nothing and xAI’s overbreadth argument from its last-minute lawsuit gets much stronger. If the answer is that any meaningful skill-intensive capability preserves the exemption, then a nudification service can escape the statute by including a professional mode--even if no one uses it--along with an easy, automated mode.

There is no guidance on burden of proof either. Nothing in the text tells us whether the exemption is an element the plaintiff must negate or an affirmative defense the provider must plead and prove. In a strict-liability statute with a $500,000 per-use penalty and treble damages, that is a pretty big issue.

4. Who and What Is This Really Going to Affect?

Who is Minnesota really trying to stop from making it easy to nudify real images? The legislative record describes a specific problem: purpose-built nudification sites, free, requiring no skill, used at scale against classmates and ex-partners and, well, anyone you can take a picture of. But the Minnesota statute will have the most trouble reaching exactly those defendants.

We do not have to speculate about this, because someone has already tried. In August 2024, San Francisco City Attorney David Chiu sued the operators of 16 of the most-visited nudify websites — sites his office found had been visited more than 200 million times in the first half of that year. The named defendants were in Estonia, the United Kingdom, Spain, China, and a handful of U.S. shells.

Eighteen months later, Chiu reported that eight defendants had been served, two had settled, default judgments were expected against three more, and one defendant still could not be located at all. And when ten of the sites did go dark, the City Attorney attributed many site takedowns to voluntary cooperation from domain registrars and registries. The enforcement campaign did produce at least one stipulated judgment: Briver LLC agreed to a permanent injunction and $100,000 in civil penalties. But the truly effective means came later.

On July 17, 2026, Chiu skipped the operators entirely. He sent cease-and-desist letters to Apple and Google over 13 nudify apps, invoking California’s facilitator liability and giving them 28 days. According to Wired and TechCrunch, Apple pulled three apps and began terminating developer accounts. Google suspended all five on its store. Two weeks, not eighteen months — because they went after defendants who cared more about their reputation than a few apps.

That is what Minnesota’s statute cannot do. A $500,000-per-use penalty is a magnificent number, but against an anonymous shell in a non-cooperating jurisdiction there is no one to serve, nothing to attach, and a default judgment that essentially worthless.

Minnesota Could Have Gone About This a Better Way

California confronted the same problem and chose to handle it far more elegantly. Minnesota asked how hard a tool for nudification is to use. California asked what the purpose of the tool is. The difference in approach doesn’t take much consideration to appreciate California’s approach.

California’s AB 621 (Bauer-Kahan), Chapter 673, Statutes of 2025, amended Civil Code § 1708.86 effective January 1, 2026. It defines a “deepfake pornography service” as a website, mobile application, or other service the primary purpose of which is to create digitized sexually explicit material. It extends liability to those who knowingly facilitate or recklessly aid or abet, and it uses a notice mechanism: a company providing services that enable a nudify site’s ongoing operation is presumed to have knowingly facilitated if it fails to disengage within 30 days of receiving evidence.

California uses a primary-purpose definition to identify a deepfake-pornography service, while its liability provisions retain consent, knowledge, disclosure, and facilitation predicates. Minnesota instead imposes a service-level prohibition keyed to the availability of nudification capability, subject to a technical-skill exemption.

Note that California did not accept a terms-of-service defense either — AB 621 provides expressly that a disclaimer prohibiting users from generating nonconsensual material is no defense. On that point Minnesota and California agree.

California’s legislative record contains the very same skill insight Minnesota codified. The Senate Judiciary Committee analysis (July 15, 2025) quotes a University of Washington Tech Policy Lab study observing that nudification applications let end-users “without technical or even Photoshop skills” generate non-consensual intimate imagery, and that AI-created imagery presents a fundamentally different paradigm from images made through Photoshop or technical skill.

Skill matters. But California treated it only as a diagnosis and then asked the more telling question — what is this service for? — because that is the question that separates a nudify site from Adobe’s Photoshop. Minnesota treated the same diagnosis as the legal test itself.

I’ve long told my children -- only complain about a problem when you can offer a solution. The solution I recommend stems from asking ‘what is the harm we’re really trying to stop with the statute?’ The harm is the non-consensual nudification and often the sexualization of images of real people. There are times when nudity is beautiful, tasteful, and artfully meaningful. So the real harm is in the non-consensual nudification and sexualization of the images, perpetrated against another. (At least, I hope no one is complaining about a tool they can use to nudify pics of themselves.)

My Solution

• prohibit all instant nudifying tools/apps (so skill is a factor, and any true artist can still sacrifice their time and expertise for their art); and

• prohibit all non-consensual nudification of images of another.

Bottom Line

It’s easy to put into words what I don’t like about the Statute, as well-intentioned as it is. Easy = banned. Difficult = completely legal. The user’s hard work and technical skill makes it acceptable. That is the rule Minnesota wrote, and that is what I despise.

After the hearing on August 19 we’ll find out what the judge does with xAI’s TRO, and that will perhaps give us more understanding at least about the constitutionality of the statute., although it likely won’t go to the reasoning behind the skill level as the deterrent.

There is clearly something wrong with one of my articles when it doesn’t include a best practices section. And this one doesn’t. And so I will end and go work on an article with more practical information for lawyers who just want to use and understand AI that will make their lives better. I will come back with Part II of this article, however, comparing the three state templates already in existence for regulating this issue.

Share

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Prompt engineering has been declared dead so many times that the obituaries now have their own genre. IEEE Spectrum ran the headline “AI Prompt Engineering Is Dead“ as early as March 2024 — though they hedged it to “long live AI prompt engineering.” I wasn’t convinced. That October, I published a full Advanced Prompt Engineering guide — because the skill was very much alive and, for lawyers, worth doing well.

Maybe just the title died. Job postings with “Prompt Engineer” in the title have fallen sharply since late 2024, and in Microsoft’s survey of 31,000 workers across 31 countries, “prompt engineer” ranked second-to-last among roles companies plan to add. But the ability still matters, it’s just now assumed. As Nationwide’s CTO put it bluntly, prompting is becoming “a capability within a job title, not a job title to itself.” Makes sense.

While postings titled “Prompt Engineer” declined, LinkedIn postings that list prompt engineering as a skill grew roughly 250%. Compensation for work that leans on the skill has risen, not cratered. That doesn’tscream death to me.

So despite the LinkedIn posts and Substack articles and notes to the contrary, prompt engineering hasn’t died. I’d say it’s grown up a bit. No more of the cheap flattery a la “You’re the best ever legal expert” and cheap tricks such as “getting the correct answer is a matter of life and death.” If you’re honest, I’d bet you used some of those tricky threats and promises but you no longer do.

What Prompt Engineering Used to Look Like

The models got good enough that “tricky” prompting stopped mattering. The were valuable prompting techniques that I taught and used. In fact, I still use some of them. And then, there were some outlandish ‘techniques’ that were actually only puffery. Things like bribes (”I’ll give you a $1MM”), saying someone’s life depended on the correct answer, or spending more time framing the role than the actual substance in the ask were hokey time wasters.

The Techniques That Died Before the list of what works, here’s what to stop doing — the prompting rituals that smarter models now make pointless:

• Flattery. “You are a world-renowned expert with an IQ of 200.” The model is not motivated by praise. A real role and a quality standard (technique 1, below) still help; the puffery doesn’t.

• “Take a deep breath” / “I’ll tip you $200.” These genuinely circulated as performance hacks. They were always throwaways--based more in hope and superstition than good practice. Research has shown them to be ineffective when tested systematically.

• Chain-of-thought on everything. Forcing “think step by step” onto simple prompts just pads the output unnecessarily. And current reasoning models already show their work when it matters.

• Elaborate few-shot examples for routine tasks. Few shot prompting had a real and justifiable basis. It was even useful to obtain things as basic as formatting. It’s now overkill for anything but very specific needs.

The machine can now prompt itself. Research has found that prompts auto-generated by the model frequently outperformed the ones humans hand-crafted. Tools that optimize prompts for you are now routine, and Gartner has projected that in 2026 a large majority of enterprises will lean on AI-driven prompt automation. If the model writes a better prompt than you do, you might as well use it.

Prompt Engineering’s Glow Up

Does anyone still say that – “glow up”? Maybe I’m once again revealing my age. But prompt engineering still matters. Especially with regard to instructions to agents. It just looks more sophisticated and elegant now.

Its gone from tricks to techniques. You still need to state exactly what you want, with the right context, constraints, and success criteria — which is just thinking clearly about the problem. No model eliminates that, and if we hand models bigger and riskier jobs, our task goes from coaxing a mediocre model into giving us something we can work with, to precisely directing a powerful one. You know this instinct from any professional context: a well-framed research question beats a vague one every time. and the model will not fix the imprecision you left in.

A noticeable shift. Although most AI models now really help with prompt engineering, we still nee context engineering — designing everything the model sees on a given call, not just the sentence you type. When Andrej Karpathy and Shopify’s Tobi Lütke both publicly argued in early 2025 that context engineering was the real skill worth developing, the industry picked it up fast. (I wrote about why this matters for lawyers deploying agentic systems in my piece on the Clawdbot disaster — when your AI has broad authority and no judgment, what it can see is a governance problem, not just a quality one).

Seven Ways to Improve What You Get from your AI Tool

These are the techniques I actually use, and recommend to lawyers, in legal work and consulting. Every one is a way of removing ambiguity the model would otherwise resolve by guessing. Remember what these tools are: prediction machines trained to produce the response a human is most likely to approve of. Reinforcement learning from human feedback improves how useful they seem, but it can also teach them to tell you what you want to hear over what's true — a documented failure mode commonly called sycophancy.

1. Assign a role and a standard that will help shape your output. “You are a helpful expert” does nothing. “Respond as a litigator reviewing this for a motion to dismiss; flag anything a judge would question” gives the model a focus and a quality bar. The role narrows the acceptable answers. When you need a specific voice or format — your own personal writing style, a particular precedent — show it an example rather than describing it (”match the structure and register of this”). That’s the only time I still bother; for ordinary asks the models no longer need the hand-holding.

2. Specify format when the format affects the substance. For a one-off, you can get the content first and reformat later, no worries. But here are two situations when you need to state the format up front. First: when you’ll reuse the prompt, and second, when the format changes how the model thinks, not just how it looks.

For example, ask a model to extract contract terms into a table with columns Provision | Party Obligated | Trigger | Deadline | Source §, and your AI reads the document obligation-by-obligation to fill each cell — it can’t leave a column blank without exposing the gap. Whereas if you ask it to “summarize the key terms” you get a smooth paragraph or bullet points that might just skip that one obligation on page 14 that didn’t seem as important. See how the format changed the output? Same document, different reasoning — because the format forced completeness. Consider whether your prompt should include a format to help force completeness.

3. Give context and constraints, not just the task. The task is “draft a client update.” The context is who the client is, what they already know, what tone fits, and what you must not say. Any ambiguity you leave in, the model will fill in for you — usually in a glossy way that isn’t especially noticeable, and worse, sometimes with content that is wrong but is hard to catch because it looks good. This is an incredibly important principle.

4. Set the boundaries of what you don’t know — and make it permanent. Tell the model to flag uncertainty, separate what it’s confident about from what it’s inferring, and say when something can’t be verified. To make this easier on yourself, stop retyping this every session and put it into persistent settings at two levels. The first is an account-wide layer; your global/custom instructions (the “personalization” settings most tools now offer). Mine include this imperative: never invent a citation; if you’re not certain a source is real, say so, and flag any assumption you’re making. If you state a fact, give me a live link to a primary source. I say some variation of that three different times in my Claude global instructions.

Claude’s Global Instructions – customize these for better outputs.

You can also add it to a matter-specific layer is a Project, Custom GPT, Gem, or folder — a scoped workspace where you load the relevant documents and standing instructions for one client or workstream, so the model carries that context into every conversation without you re-explaining. Think of it as one custom instruction set for how you always work, and one per matter for what this work is.

5. Don’t believe everything your AI tells you. There’s a running debate that AI is making us lazier thinkers. I’d argue the opposite: you have to think harder now, because the answers come out silky smooth like a buttery chocolate truffle — easy to let them melt away, lulling you into a brief happy stupor, whether or not they’re right. The skill you need to develop is resisting that gloss long enough to check that the substance is correct. It sounds good even if it’s wrong, and you would have caught it had it not been stated so smoothly. Think through all of the principles. Or better yet, add all of your points, or contentions into your AI tool, then ask the AI to build around them. Follow up by asking what you missed, or three ways to make to make the output better. But always, always, challenge the reasoning, demand the source, or ask “what would make this incorrect?” If in doubt, push back and make it defend its answer.

6. Engineer the context. For anything beyond a one-off, control the whole information environment — which documents the model can see, what’s in the system instructions, what history it’s carrying, what tools it can call. A mediocre prompt with the right context beats a beautiful prompt with the wrong context every time. Models have real limits on what they can reliably hold and reason over at once. Even the newest, most powerful iterations of AI tools how context limits. Use those context windows to your advantage. For example don’t ask for ‘a full contract analysis’ of a 250 page complex contract in one shot. Ask it to (a) extract every obligation, then (b) flag the unusual ones, then (c) draft proposed edits. Each step stays within the model’s reliable working range, each is checkable, and errors don’t compound without you knowing — which, not coincidentally, is also how you keep a human in control of the output. Gain insight into and understanding of context and how to use context engineering to your benefit here.

7. Have your model interview you before it answers. This is the most underused technique I know, and it genuinely improves your output. It works precisely because the models got better at recognizing what they don’t know. Instead of trying to anticipate every constraint yourself, make your AI tool do the work. I end nontrivial prompts with “What questions do you have for me before you start?” You’ll get back questions that will help to fill in the gaps you didn’t think to fill. Even with AI tools that are fairly good at asking follow up questions without being prompted, I still find this gives me the best output.

The Bottom Line

Prompt engineering was a thing. It was important and necessary. Not so much anymore, but there are still techniques that make your output higher quality. And two more quick bonus tips: First, your AI tool might have the “perfect my prompt” button. Sure, it will fill out a thin prompt, but read this ‘plumped up prompt’ carefully. Is it really better, or it is making assumptions that are generally appropriate, but are skewing the answer? Second, please ALWAYS CHECK EVERY CITATION. Always.

Subscribe now

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

TL;DR: The output from AI platforms is important. Guardrails must prevent AI tools from regurgitating copyrighted materials. But a case currently under consideration in the Third Circuit — Thomson Reuters v. Ross — is being fought at the ingestion stage. It’s about a copy made for training. And I expect the Third Circuit’s opinion to reflect that non-infringing outputs won't save a platform if it made copies of copyrighted materials, then used those to train on a competitor's proprietary data to build a head-to-head substitute.

Two years ago I wrote about who is actually on the hook when copyrighted work gets pulled into an AI model. I walked through the service providers, the users, and the model creators, and I closed by flagging one case that did not fit the comfortable pattern. I promised to revisit that case. Here is the promise I made in Part 1:

“[T]he recent case of Thomson Reuters Enterprise Centre GMBH v. Ross Intelligence Inc., gives us a glimpse into a situation where one party used copyrighted materials in a more significant way. But we’ll review that case in detail in Part 2 of this Article.”

This is Part 2. Ross has now gone from a Delaware courtroom to the Third Circuit, and is on track to be the first federal appeals argument in the country on whether training an AI system on copyrighted material qualifies as fair use. The Third Circuit heard argument on June 11, 2026 (No. 25-2153). I read the transcript so you don’t have to, and I read trial Judge Bibas’s opinion twice.

The Background

Ross Intelligence built an AI-powered legal research platform meant to compete with Westlaw. To train it, Ross wanted Westlaw’s headnotes. Thomson Reuters said no, because Ross was creating a direct competitor. So Ross went to a vendor, bought roughly 25,000 “bulk memos” created from those headnotes, and trained on them. In Thomson Reuters Enterprise Centre GmbH v. Ross Intelligence Inc., No. 1:20-cv-613-SB, 2025 WL 458520 (D. Del. Feb. 11, 2025), Judge Stephanos Bibas held the headnotes original and protectable, found direct infringement on 2,243 of them, leaving other headnotes and questions of copyright validity for a jury, and rejected Ross’s fair use defense. He decided Factors One (purpose and character of the use—was it transformative?) and Four (effect on the market) for Thomson Reuters and Factors Two (nature of the copyrighted work) and Three (the amount and substantiality of the portion used) for Ross, then certified the question for the interlocutory appeal now in front of the Third Circuit.

Note that this is an AI decision, but not a generative AI decision. Ross is not a chatbot. It does not write your brief or hallucinate a case citation for you. A lawyer asks a question in plain language and the tool returns quotes from real judicial opinions. As Ross’s counsel put it at argument, “[t]here’s no [Westlaw] headnotes in what we teach the public… [i]t’s just quotes from the judicial opinion.” That fact is at the heart of this decision.

Where Part 1 Holds Its Ground

In Part 1 I drew a line between mainstream, guard-railed, generative models on one side and copying that does real competitive damage on the other. That is exactly the line the Third Circuit spent the time arguing about.

Both advocates agreed on the boundary, which almost never happens. Ross’s lawyer told the Third Circuit panel, “you cannot just say AI.” Thomson Reuters’ lawyer, Dale Cendali, made the same point from the other direction, warning the court that “[y]ou can’t just say AI and have that just be across all fact patterns.” Judge Montgomery-Reeves pinned it down with Ross directly.

JUDGE MONTGOMERY-REEVES: … [Y]ours is not generative AI, right?

MR. DAVIES: It’s not generative AI, Your Honor…

A tool that copies a competitor’s editorial work to build a substitute for that same competitor is in a completely different category from a generative model trained on a vast and varied corpus. Judge Bove framed the stakes in plain terms near the end of the oral argument, calling the case one “about balancing what we have and where are the red lines.” The line is substitution, and Ross stepped over it. Bibas drew the same line in his district court opinion, pausing to clarify that “only non-generative AI is before me today.” In other words, he went out of his way to keep Gen AI out of this holding.

Where Part 1 Needs Sharpening

Bibas revised his own 2023 opinion in this very case, and he opened with a line I loved, that “[a] smart man knows when he is right; a wise man knows when he is wrong.”

In Part 1 I emphasized the idea that a copyright violation requires a “publication,” and I argued that feeding material into a model is not a publication because the information will not come out of the LLM in an exact replication, so there is no infringement in putting copyrighted material into an LLM. That framing may have been too generous to the model builders. Infringement turns on the exclusive rights in Section 106 of the Copyright Act, and the reproduction right under Section 106(1) stands on its own. According to District Court Judge Bibas, the copies made to assemble and ingest the training set are themselves the infringing acts. Distribution is a separate right, and you do not need it for liability to attach.

Look at how Ross actually lost. Ross never showed a copyrighted Westlaw headnote to a user; that would have clearly been publication and distribution. Instead the Ross search results were quotes from ‘non-copyright-able’ judicial opinions, and that clean output actually gained the Third fair-use Factor—the amount and substantiality of the portion used—for Ross, because Ross made no headnote “accessible to a public for which it may serve as a competing substitute.” But Ross lost anyway. The court found that the infringing copies were in the training data. LegalEase built roughly 25,000 bulk memos out of Westlaw headnotes, Ross trained on nearly all of them, and Bibas found actual copying and substantial similarity on 2,243 headnotes. Clean output did not cure the fact that a copy was made to put into the model.

Two corrections follow for anyone familiar with my earlier framework. First, as to copying, copyright infringement is largely a strict liability tort. I described creator liability as something that turns on a reckless or intentional state of mind, e.g. the builder who knowingly lets protected work leak back out. In fairness to my earlier statement, there’s an active academic debate about whether the overall structure including fair use and secondary liability is truly strict liability, but I should have qualified it. What matters here is that Ross had no such intent on the output side, and it did not matter. Ross argued innocent infringement to mitigate statutory damages; the court rejected that argument based on the presence of copyright notices.

Secondly, Part 1 cited Authors Guild v. Google, Inc., 954 F. Supp. 2d 282 (S.D.N.Y. 2013), and credited the holding to the Second Circuit. That reporter cite is the district court. The Second Circuit’s affirmance, the one Bibas himself relies on, is Authors Guild v. Google, Inc., 804 F.3d 202 (2d Cir. 2015). And that court’s reasoning helped Ross, especially in regard to the Third Factor, because Ross put no headnotes in front of the public. What beat Ross was Factor One and Factor Four, purpose and market effect.

Training vs. Copying

Key to AI and copyright protections is the knowing the difference between copying and training. Training is a purpose; copying is an act. The threshold question in copyright infringement —did you reproduce protected expression?—does not turn on purpose. Section 106(1) is strict liability, and making the copy is the violation. Purpose re-enters one step later, when one tries to use a fair use defense.

The first question is was protected expression reproduced at all? If a system ingests only facts or ideas, Section 102(b) and Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991), say there is nothing to infringe. Second, if a copy was made, was it licensed or excused by fair use?

Was A Reproduction Made?

In considering whether a copy was made, it helps to separate the copies a copyright claim might target. Start with the original work; the book, article, magazine, image or piece of art. If a copy of it is made for ingestion by an AI model, as it was in Ross, that is the first copy. The second copy is the information residing in the model itself; whatever information is embedded in the model’s trained weights. Technically, those weights are a compressed, parametric representation of the training data, not literal page‑by‑page copies. Whether they qualify as a ‘copy’ for copyright purposes is contested. Some scholars argue they should be treated as compressed reproductions, others disagree.

An LLM does not store a clean copy of every work it learned from, and it usually cannot reproduce them verbatim—with the possibility of heavily duplicated works. Which leads us to the third copy; the output the tool hands back to a user. Guardrails and refinements in newer models make verbatim extraction much harder, and the best-defended systems resist it well. But even with all of that, verbatim output is still not impossible—the memorized text remains in the weights, and guardrails only filter what surfaces. As recently as 2026, researchers pulled large portions of copyrighted books—well over 70% of a single title from several production models, some without any jailbreak. Only one consumer model resisted almost entirely. Which helps the New York Times since that is the theory they maintain against OpenAI.

Think of it this way. A lawyer can read Westlaw, internalize it, and write their own original headnotes -- no liability. A lawyer can learn from a book without infringing, but the infringement occurs if the lawyer photocopies the book to learn from it without a license or fair use, even if they discard the infringing photocopy afterward.

Was There a Justification for Making a Copy?

Ross’s argument was that it copied Westlaw’s materials only to reach the underlying, un-copyrightable law. That is the intermediate-copying rationale it used in trying to shelter that copying under the software reverse-engineering cases, where courts treated intermediate copying of computer code as fair use. Bibas called those cases “inapt.” They are about programs that “serve functional purposes,” and in each one the copying “was necessary” to reach unprotected functional elements. Sega Enterprises Ltd. v. Accolade, Inc., 977 F.2d 1510 (9th Cir. 1992); Sony Computer Entertainment, Inc. v. Connectix Corp., 203 F.3d 596 (9th Cir. 2000); Google LLC v. Oracle America, Inc., 593 U.S. 1 (2021).

Headnotes are not code, and as Bibas put it, “[t]here is nothing that Thomson Reuters created that Ross could not have created for itself or hired LegalEase to create for it without infringing.” In other words, copying does not earn a pass just because it happens during training. Headnotes are protected editorial expression, not functional code where copying is technologically necessary to reach unprotected elements.

A Market for the Data

The most consequential part of the ruling is what Bibas did with Factor Four. He recognized a market for AI training data itself, and he held that harm to that market counts, writing that “it does not matter whether Thomson Reuters has used the data to train its own legal search tools; the effect on a potential market for AI training data is enough.” He reached that market as a potential derivative one, the kind “creators of original works would in general develop or license others to develop.” Ross did not put forward enough evidence to show the market was not there.

This actually vindicates the economic point I made at the end of Part 1, that the authors’ real grievance is about a licensing market. Creators deserve to be rewarded for the content they create — that is the whole point of copyright law. The backup theory of unjust enrichment I suggested in Part 1 is perhaps the long way around, but I think it still holds legal weight.

The Generative AI Cases

While Ross was in process on its way to a decision in the Third Circuit, two California judges handed AI developers real wins, and those cases are instructive. They are discussed in greater detail in a separate article, but following is a short consideration to show how Gen AI must be considered differently than non-generative AI.

In Bartz v. Anthropic, PBC, No. 3:24-cv-05417 (N.D. Cal. June 23, 2025), Judge Alsup called training on lawfully acquired books “exceedingly transformative” and held it to be fair use, while ruling that downloading and warehousing millions of pirated books in a permanent library was not. In Bartz the infringing conduct was not the training itself but the downloading and warehousing of pirated books; training on lawfully acquired copies was fair use, so provenance was the catchpoint. In Kadrey v. Meta Platforms, Inc., No. 23-cv-03417-VC (N.D. Cal. June 25, 2025), Judge Chhabria handed Meta a fair use win on training, then went out of his way to say the plaintiff authors lost because they failed to develop a market-dilution argument, not because the law was on Meta’s side. He all but invited the next set of plaintiffs to make that argument.

Read the three together and what we learn is that generative training on a broad, lawfully obtained corpus has a strong transformativeness. Copying to build a head-to-head substitute does not. Provenance matters—hello data governance--because pirated inputs (copyright infringements) sank part of Anthropic’s defense. Market harm matters most of all, as noted by Chhabria.

The Substitution Line, and a Forecast

Put Ross, Bartz, and Kadrey on a continuum. On one end sits transformative use: generative training on a broad, lawfully acquired corpus, which Alsup called “exceedingly transformative.” On the other sits substitution: copying a competitor’s editorial work to build a head-to-head replacement for that same competitor, which is what sank Ross. Transformativeness (Factor One) and market harm (Factor Four) are not two questions, but one question asked in a different way, in practicality if not in court practice. The more a use substitutes, the less it transforms, and a substitution strains the market the original owner was going for. In other words, the more of one, the less of the other; they sit on a sliding scale rather than in separate boxes.

Here is my forecast, offered only as a prediction. I expect the Third Circuit to affirm on liability, and to do it narrowly. The panel worked hard at argument to fence generative AI out of the holding—Montgomery-Reeves pinned Ross’s counsel down that this “is not generative AI,” and Bove described the case as one about “where are the red lines.” A court that careful to box in its ruling is one I’m expecting to be a court preparing to rule against the copier while leaving the generative question for another day and another set of facts. If I am right, the opinion affirms on Factors One and Four, blesses a licensing market for training data, and expressly reserves the generative-AI question—handing the next set of plaintiffs--the Bartz and Kadrey authors--the market-dilution theory Chhabria all but invited.

If the Third Circuit affirms, this becomes the first appellate ruling squarely on AI training and fair use. And I feel the need to remind readers that these are not new principles created for a new technology. Current principles being applied to new technology is sufficient. Fair use has always asked about purpose and market. The courts are just applying that to machine training and output now.

The Bottom Line

This case is different than other AI copyright cases. Ross had clean output and still lost because it trained a competing product on the competitor’s own copyrighted work, and because it did not need that copyrighted material work to build its own product. Common sense. Data provenance and licensing are governance question now. If ignored they can become litigation questions later. If a licensing market for training data is real—and I believe that’s where we’re headed—then “we only trained on it” will keep losing in court. All of which brings me back to my catchphrase of the year, “Data governance is everything when it comes to AI.”

I will write a short follow-up when the Third Circuit rules. Until then, watch Factor Four.

Subscribe now

.© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

TL;DR:

Trump’s June 2, 2026 AI Executive Order is the most carefully drafted of his three AI EOs I’ve written about. It is also the most architecturally significant. It builds a federal channel for pre-release access to the most capable AI models — run by NSA, on a classified benchmark — but disclaims any mandatory authority. The architecture will outlive this administration. Whoever holds the switch next decides whether it stays voluntary. The deeper problem is one I have written about three times now: we keep governing AI by presidential signature rather than by statute. A regime that exists by signature dies by signature. Frontier developers, critical-infrastructure operators, and our allies cannot build durable strategy on rules that vanish with the next election.

This is the third Trump-administration AI executive order I’ve written about. In January 2025, it was Executive Order 14179, “Removing Barriers to American Leadership in Artificial Intelligence,” and I warned DOGE was about to hollow out the National Institute of Standards and Technology (NIST) and the new U.S. AI Safety Institute (AISI). In December 2025, it was Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence,” and I argued that pursuing nationwide uniformity through executive directive — a litigation-and-leverage strategy aimed at states — would create more uncertainty than it cleared. Both critiques still stand.

On June 2, 2026, Trump signed Promoting Advanced Artificial Intelligence Innovation and Security. The December Order looked outward, at states. This one looks inward — at federal systems — and outward at the small handful of companies building the most capable AI models on the planet.

Why the Better-Drafted Order Worries Me More

To be fair, the June Order is better drafted, better staffed, and aimed at a real problem in a way the December Order was not. It addresses cybersecurity threats from advanced AI by setting up a clearinghouse and CISA directives. The express disclaimer of mandatory licensing in Section 3(c) is a meaningful guardrail. If I were grading executive orders on craft, the June Order would receive a higher grade than December’s.

That makes the concern about it harder to articulate, and easier to overlook. What concerns me is the architecture the Order leaves behind — a classified federal evaluation channel for the most powerful AI models, designed under one administration and inheritable by every administration that follows. And it is the deeper pattern, which has now repeated three times: we keep governing the most consequential technology of our time by presidential signature rather than by statute.

A regime that exists by signature dies by signature. The first Trump AI EO revoked two of Biden’s on Day 1. A successor administration — of either party — can revoke this one with a stroke of the pen, then build something new in its place. Frontier developers, critical-infrastructure operators, and our allies cannot build durable strategy on rules that vanish with the next election. They are doing so anyway, because they have no alternative.

Consider what happens when we rely entirely on this kind of ad hoc, “honor-system” governance. In April 2026, Sullivan & Cromwell apologized to a federal bankruptcy judge for an emergency motion containing roughly forty AI-generated errors — fabricated citations, wrong volume numbers, and quotations attached to cases that did not contain them. The firm acknowledged it had internal AI policies that were not followed.

If one of the most elite firms in the country, operating under written policies and decades of partner experience, can produce a filing like that, the limits of voluntary compliance are clear. Honor systems fail without structural, verified enforcement. The same logic applies at the federal level. Voluntary frameworks built by executive order have the same limits.

Hold that thought as you read what the Order actually does.

What the Order Actually Does

Four things, in plain English:

• Hardens Federal Defenses: Hardens federal civilian, the Department of Defense (given the second name by Donald Trump of “Department of War”), and National Security Systems against AI-enabled cyber threats. CISA, NSA, OMB, OPM, Treasury, and DOJ lead, mostly on 30- and 60-day clocks.

• Launches a Cybersecurity Clearinghouse: Creates a Treasury-led “AI cybersecurity clearinghouse” to coordinate vulnerability discovery and patching across industry and critical infrastructure — voluntarily.

• Establishes a Pre-Release Gate: Creates a classified NSA benchmark for when an AI model becomes a “covered frontier model,” and invites developers of those models — voluntarily — to give the federal government access for up to 30 days before public release.

• Prioritizes Criminal Enforcement: Directs DOJ to prioritize criminal enforcement under 18 U.S.C. § 1028, § 1030, and § 1343 against actors who use AI to break into systems or commit fraud.

The Silent Pivot Away From NIST

To me, the most consequential thing about this Order is something it does not announce. Federal AI policy now runs through the intelligence community rather than the standards community.

In January 2025 I worried that DOGE-driven cuts at NIST and AISI would hollow out the government’s capacity to evaluate frontier AI. The June Order does just that — though not the way I expected. The administration did not need to defund NIST. It simply routed around it.

Under Biden’s Executive Order 14110, NIST’s U.S. AI Safety Institute was the federal interface with frontier developers. Labs signed voluntary agreements to share access for safety evaluation. The framing was open: bias, dual-use risks, civil rights, safety. The methodology was public. NIST’s counterparts at the U.K. AISI and the EU AI Office could coordinate with it.

Trump revoked EO 14110 on his first day back in office. The June Order is the realization of his transition. NIST, once considered the gold standard, is named only as a consultant. National Security Administration (NSA) leads, with Cybersecurity and Infrastructure Security Agency (CISA), the National Cyber Director, and the Department of War a/k/a the Department of Defense. The benchmark is classified. The threshold for what counts as a “covered frontier model” will be set inside the IC — never published, never peer-reviewed.

The rebrand reflects more than rhetoric. It signals a fundamental shift in how the administration views this technology. By passing the core responsibilities from a civilian standards agency like NIST to an intelligence agency and a defense department explicitly focused on warfare, the administration is effectively treating advanced AI less as a commercial platform and more as a national-security asset.

This is part of the fragile architecture of EO’s I’m describing. The AI Security Institute (AISI) was a Biden-era institution built by signature. The June Order sidelines it by signature. Whatever NSA builds in its place will be built by signature. None of these rests on a statute. Likewise, none of these has to survive 2029.

The real costs to the shift, beyond the by-signature problem:

• Measuring success will be hard if not impossible. This plan includes a classified benchmark. But a classified benchmark cannot be peer-reviewed, replicated by independent researchers, or used to drive system-wide commercial standards.

• The U.S. can’t speak with allies about methods. The U.S. position at the OECD, the G7, the UN, and the Seoul/Bletchley network of AI safety institutes is instantly weaker, because the lead U.S. agency cannot speak publicly about its methods.

• Conflict of interest. NSA both develops offensive AI cyber capabilities and now defines what counts as a powerful AI model. That’s a massive concentration of authority for governing a powerful technology, and it desperately deserves congressional oversight.

Voluntary Today, Mandatory Tomorrow?

The most architecturally significant thing the Order does is build a federal channel for pre-release access to the most capable AI models — and then disclaim it.

Section 3(b) tells NSA, Treasury, and CISA to design a voluntary framework: developers can engage the government to determine whether a model qualifies as “covered,” can provide pre-release access for up to 30 days, and can collaborate on selecting trusted early-access partners. (Earlier drafts apparently called for 90 days; the 30 was the compromise that got the Order signed.) Section 3(c) then expressly disclaims any mandatory licensing or preclearance regime.

If you’ve ever drafted a contract that started “For the avoidance of doubt, nothing herein shall…,” you already understand Section 3(c). You don’t disclaim a power you didn’t nearly create.

This is the second piece of that architecture. The Section 3(b) channel will exist whether the next President favors red, blue, or something none of us have heard of yet. Building the channel is the hard part. Flipping the switch from “voluntary” to “mandatory”? That’s easy. The disclaimer in Section 3(c) holds only as long as the Order itself holds — and executive orders do not always hold for long, just as former President Biden.

Note that this is not a partisan observation. It would be equally true if a Democratic president had built this architecture. Once the pipeline exists, the next time a frontier model is implicated in a major cyber incident — or in election interference, or in a critical-infrastructure attack — the political pressure to make participation mandatory will be enormous.

A Frontier Lab’s Dilemma

Consider what happens to a frontier lab — OpenAI, Anthropic, Google DeepMind, xAI, or Meta — preparing a major release in late 2026. Under the Order, the lab is invited (voluntarily) to engage NSA early to determine whether the model qualifies as “covered.” If it does, the lab is invited (voluntarily) to provide 30 days of pre-release access under confidentiality, cybersecurity, insider-risk, and IP terms as yet undefined.

Counsel has to advise on at least:

• The Upside: Goodwill with the intelligence community, a public claim of responsible release, and possibly some real technical value if the NSA finds genuine vulnerabilities.

• The Downside: 30 days of lost release-cycle time, exposure of pre-release internals to an agency with its own offensive cyber mission, and an institutional precedent that may be cited against the lab later.

• The Confidentiality Terms: Stronger protection from public disclosure than a NIST agreement offered, but weaker protection from intra-government use of the lab’s proprietary information.

• The Cost of Declining: Officially nothing. But, the lab might be the only one without a public answer when the next congressional hearing asks who is “participating in the President’s voluntary framework.”

These questions will be answered model by model, lab by lab, with very little public visibility. That is the practical effect of a “voluntary” federal regime backed by classified evaluation — and created entirely by signature.

Geopolitical Fallout

In my January 2025 article I flagged that a U.S. retreat from structured AI governance — the Paris AI declaration, the U.K.’s decision to delay its AI rules to align with the U.S. — would fragment international standards and complicate compliance for U.S. companies operating abroad. The June Order deepens that retreat.

The new Digital Omnibus on AI Regulation (successor to the EU AI Act) requires transparency, documentation, and systemic-risk evaluation for general-purpose AI models, through open civilian standard-setting. The U.S. counterpart is now a classified NSA benchmark that by definition cannot be cross-walked to the EU regime in any public way. A U.S. lab participating in the federal voluntary framework gains no portable credit toward EU AI compliance, and an EU regulator cannot independently verify what the U.S. benchmark measures. Our allies are governing AI by legislation. We are governing it by directive.

Best Practices

For lawyers advising clients in the wake of the June Order, best practices depend heavily on who you represent:

• For Frontier Developers: If your client could plausibly develop a “covered frontier model,” (first, be thankful for a well-funded client, and then) start negotiating the confidentiality, insider-risk, and IP terms for any voluntary access arrangement. The classified threshold is not public, but the population of likely candidates is small and well-known.

• For Critical Infrastructure Operators: If your client runs critical infrastructure — hospitals, community banks, utilities, water systems, or telecom infrastructure — track the forthcoming CISA Binding Operational Directives and the Treasury clearinghouse. Both could change vendor diligence, incident-response obligations, and indemnification posture.

• For Multinational Clients: Maintain separate compliance tracks. Assume U.S. and EU AI frameworks will not align in this administration. Do not assume U.S. participation in any voluntary federal framework provides an ounce of credit toward EU AI Act or U.K. obligations.

• For General Corporate Compliance: Document everything. Voluntary federal evaluations that produce no public record can still produce private liability — and the next administration may treat “participated” and “did not participate” very differently.

• For Litigators: Keep monitoring state AI laws. The December Order’s litigation-and-leverage strategy has not cleared the field. Until Congress acts, state laws remain the most likely source of binding obligations for most clients.

The Role of Congress

For those of us who write about AI governance, the June Order is the third reminder in eighteen months that the United States still does not have a coherent statutory framework for the most consequential technology of our time — as if any of us needed a reminder. We have a December EO pressuring states. We have a June EO inviting frontier developers into a classified evaluation channel. We have a National Cyber Strategy, an AI Action Plan, the Genesis Mission, an AI export framework, an anti-“woke AI” directive, and a pediatric-cancer-AI directive.

And yet, we still do not have a federal statute.

If lawyers and policymakers want a national AI framework that will outlast the next election, the answer is the one I have written each of the last three times. Congress should debate and enact a durable AI framework. And courts should remain the backstop, not the engine, of AI governance.

The June 2026 EO, well-drafted, well-staffed, narrowly scoped, is still an executive order at the end of the day. It can quickly be undone by the next person who occupies this desk.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

TL;DR

Two recent federal court orders — Miller v. Regions Bank (N.D. Ala. May 21, 2026) and Couvrette v. Wisnovsky (D. Or. Dec. 12, 2025, with follow-on order Mar. 23, 2026) — show that the worst-case outcome of AI use is rarely the hallucination itself. It is the lawyer’s response after the hallucination is caught. Both courts say plainly to the attorney-offenders ‘own the mistake or lose your case, your bar standing, or both.’ This article walks through the two orders, then gives firms 7 Best Practices to put in place in your firm.

The Cover-Up -- Miller v. Regions Bank

On November 26, 2025, a solo practitioner in Alabama named H. Gregory Harp signed up for a paid ChatGPT Plus subscription. Four days later, he filed an opposition to summary judgment in Miller v. Regions Bank, No. 2:24-cv-1324-HDM (N.D. Ala.). The brief contained four quotations attributed to real Eleventh Circuit and D.C. Circuit decisions. The cases were real. The quotations were not.

U.S. District Judge Harold D. Mooty III pulled the proverbial thread. With falsity now exposed, he issued a show-cause order on the four false quotations and ordered Harp to either produce the underlying authorities with the quotations highlighted, or submit a sworn declaration explaining how the brief was generated.

Harp’s first response he had not used AI.

At the April 20, 2026 show-cause hearing, that story changed a bit. Harp now said he used ChatGPT “to do a general search,” but no AI “wrote a single word” of the brief. Pressed, he conceded the quotations “could have been generated by ChatGPT” — but he had not checked his ChatGPT history. He volunteered, on the record, to pull the log.

The court took him up on it. The same day, Judge Mooty entered an in camera production order to turn over the screenshots of every ChatGPT conversation related to the case.

Three days later, on April 23, Harp deleted his ChatGPT account. Not just canceled it — he requested a prorated refund, which forfeited his read-only access through the end of the billing cycle on April 30 (one day past the court’s production deadline). His later declaration framed the deletion as a contrite, post-hearing decision: “After the hearing I was extremely upset that I had used ChatGPT at all.” The OpenAI emails he was forced to produce told a different story.

The Court’s view of that framing is worth quoting in full:

“The court is not ordering the harshest of Attorney Harp’s sanctions because he made a mistake. The court is ordering them because, when confronted with that mistake, he chose dishonesty over candor and destruction over disclosure. Lawyers make errors. Competent and ethical lawyers own [their mistakes].”

On May 21, 2026, the court sanctioned Harp under Rule 11, its inherent authority, and Alabama Rule of Professional Conduct 3.3, and held him in civil contempt. The order:

1. Publicly reprimands him, with a publication requirement (he must serve the order on every client, opposing counsel, and judge in his open cases);

2. Disqualifies him from Miller and stays the case for 60 days to let the client find new counsel;

3. Suspends him from practice in the Northern District of Alabama for six months;

4. Refers the matter to the Alabama State Bar; and

5. Draws an adverse inference that ChatGPT generated the fabricated quotations (and likely other misstatements the court flagged), based on the bad-faith spoliation finding.

Critically--and this is the heart of the point I’m trying to make--the Court drew a sharp line between the underlying error and the cover-up. The Rule 11 sanction for the false citations was the public reprimand. The disqualification, suspension, and bar referral were for the cover-up; the lies and the spoliation.

The Skyrocketing Dollar Figure -- Couvrette v. Wisnovsky

If Miller is the cover-up case, Couvrette v. Wisnovsky, No. 1:21-cv-00157-CL (D. Or.), is the volume case — and, as of this writing, the largest AI hallucination penalty in U.S. history.

The underlying lawsuit was a family fight over Valley View Winery in Jacksonville, Oregon. Joanne Couvrette sued her two brothers for control of the family vineyard, alleging elder abuse and seeking roughly $12 million. In early 2024, San Diego attorney Stephen Brigandi appeared pro hac vice for Couvrette. Because he was not licensed in Oregon, Portland landlord-tenant attorney Tim Murphy signed on as local counsel.

Across three briefs related to cross-motions for summary judgment, the plaintiff’s filings contained 15 nonexistent cases and ten fabricated quotations. When defense counsel flagged the problems, Brigandi did not concede. Instead, he filed a useless Notice of Errata, without acknowledging the fake cites or quotes. And here’s the funniest part to me — he re-filed without verifying the remaining citations, which themselves continued to misstate the law.

Judge Clarke’s opinion is unsparing, showing he had no qualms in terminating a $12.6 million claim:

“In the quickly expanding universe of cases involving sanctions for the misuse of artificial intelligence, this case is a notorious outlier in both degree and volume. ... If there was ever an ‘appropriate case’ to grant terminating sanctions for the misuse of artificial intelligence, this is it.”

The cover-up won the attorneys and their client a sanctions package of approximatey $110,000. Judge Clarke’s December 12, 2025 Order, his Order from March 23, 2026 and his Order from March 30, 2026 set forth the sanctions and award of attorneys’ fees. It’s structured to hit three different people:

Brigandi (pro hac vice counsel)

$80,498.72 in opposing-party attorney fees plus $15,500 in fines. The court also struck the action without leave to refile.

Murphy (local counsel)

$14,205.66 — 15% of defendants’ fees — imposed in the follow-up order of March 23, 2026 for failure to meaningfully supervise pro hac vice counsel.

Couvrette (the client)

The court found she shared responsibility as so her claims of $12.6 million were dismissed with prejudice as terminating sanctions, and the matter was referred to the Oregon State Bar.

The lesson from Judge Clarke matches Judge Mooty’s, even though the misconduct profile is different. Clarke wrote, “Plaintiffs and their counsel have not been adequately forthcoming, candid or apologetic about their conduct.” And on the attempted fix, “There is no evidence that Mr. Brigandi took any steps to verify the veracity of the legal arguments contained in the amended briefing, which continue to contain misstatements of law.”

Three Threads Running Through Both Orders

Read together, Miller and Couvrette point to the same three points of failure — and they are ones I’ve talked about and written about, but they are the ones we aren’t doing a good enough job covering in most CLEs.

1. The Hallucination Is Sanctionable, But The Cover-up? It’s Career-Altering.

Both courts went out of their way to separate using an hallucinated case versus covering that fact up. Judge Mooty imposed a public reprimand for the false quotations alone — a serious but survivable sanction. The career-ending sanctions (disqualification, six-month suspension, bar referral) resulted from the deletion and the story that surreptitiously changed. Judge Clarke followed the same logic. The briefs themselves earned fees and fines, but the dismissal with prejudice — “terminating sanctions” — came from the lack of candor and the attempted cover-up.

2. Your Chat History Might Become Evidence Against You.

Here’s another thing we don’t cover nearly enough in CLE’s, bar opinions, or friendly conversations. The moment a court raises an AI question, the lawyer’s chat history becomes subject to the same preservation duty as any other electronically stored information. Miller applies the Eleventh Circuit’s bad-faith spoliation framework to a ChatGPT account and draws an adverse inference. Practitioners should assume that deleting a chat history after AI use is questioned will be treated, at minimum, as bad-faith spoliation under Rule 37(e)(2) and the court’s inherent authority — regardless of jurisdiction. This, of course, immediately causes me to point that the best AI use is based on the most solid Data Governance. But that, of course, is an article or CLE for another day.

3. Local Counsel’s Signature Is Not Just a Pro Forma Requirement.

Murphy showed up and signed the documents. That is a common, routine way for local counsel to make a bit of extra money. It’s essentially been a pro forma act. A rubber stamp. But now after Murphy’s sanction in Couvrette is the death knell for just signing as a matter of course or procedure.

“Procedural” local counsel is a fiction we may be living under, but that’s almost certainly not how it was originally intended. And the court declined to accept it. This will not be the last case where local counsel is sanctioned for signing a brief with AI-generated falsity. If you sponsor a pro hac vice admission and sign on as local counsel, you now own a real obligation to supervise because that obligation might be enforced, as it was here, with a loss of tens of thousands of dollars. I’m curious how much Murphy originally received to act as local counsel.

Best Practices -- 7 Practical Rules Every Firm Should Adopt

None of these require a new platform purchase. And, all can be implemented at a solo or small-firm level.

1. Adopt a written cite-verification SOP. Add to your AI Policy that every AI-assisted brief gets two-person verification. The drafter pulls the underlying authority and highlights the quoted language; a second attorney, paralegal or assistant checks against the source. No filing leaves the firm unless every quotation and every case has been independently confirmed in a primary source. At the very least, go through these suggestions, such as running your final brief through Perplexity and asking it to verify your cites and quotes (no, that is not a substitute for human verification, but it’s better than nothing).

2. Treat your AI chat history as evidence the moment a court raises the issue. It’s good data governance to delete confidential or sensitive chats the minute you are finished with them. But it’s spoliation to do so after a potential problem is raised. Larger firms should route deletion authority through a partner — not the lawyer under inquiry.

3. Add a Clause to Your AI Policy. Decide now, in writing, how the firm responds the first time a court flags a suspect citation. My suggestion is a same-day acknowledgement and apology, a written declaration of how the brief was generated, and full production of AI logs. Both judges in these cases said the response that would have preserved the lawyer’s career was contrition and disclosure on day one. And we’ve seen that in other cases.

4. Consider the Quality and Settings of the Tool You are Using. ChatGPT Plus is a consumer product. For client work, use tools with zero-data-retention, tenant isolation, and obtainable audit logs — not because they hallucinate less, but because the audit trail proves you did the verification work when the court asks.

5. Add an AI certification block to every brief. Track the federal trend: 30+ district courts and 300+ individual judges now require some form of AI disclosure or certification. A standing internal form — “AI used: yes/no; tool: ___; verification performed: ___; verifier: ___” — protects the file, satisfies most standing orders, and adds more force behind what should be happening anyway.

6. Change your local-counsel and pro hac vice Agreements. If you are local counsel, write into the engagement what supervision you will actually perform on filings — and price the matter accordingly. If you are visiting counsel, expect (and welcome) a real review, but don’t count on it, unless you are paying local counsel accordingly.

7. Train associates and staff on the candor rule. Many (and I suspect most) AI sanctions cases start with a paralegal or associate cutting a corner under deadline pressure. Train the whole team that the right response to “I think I may have failed to check a cite” is to raise it to a partner the same day. Build double checking all cites into your firm training.

Bottom Line

The AI hallucination problem is now well past its novelty phase. In fact, I’ve stopped feeling so incredulous when I see a new case of fake cites. Courts are moving quickly from “caution” to “escalating consequences.” And in my experience there is generally nothing a judge or court hates more than lawyer misconduct and lawyers responding disingenuously to the court. As bad as hallucinations, fake case cites, and fake quotes are, the coverup is always worse.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

The Remedies Phase That Every Lawyer Should Be Watching

Three weeks ago, I wrote about Musk v. Altman as a records-disposition lesson. Useful piece, hopefully. But it was a snapshot from day two of the trial, and a lot has happened since. Closings wrapped Thursday. The jury started -- and finished—deliberating Monday 5.18.26. Many readers will see “unanimous jury verdict” and think the case is over.

It isn’t. And the procedural reason it isn’t is also important. The real action is in this case is what happens after the jury speaks.

Where the Case Actually Is

Musk started with 26 claims. By the time trial began on April 27, Judge Yvonne Gonzalez Rogers had whittled them down to two— breach of charitable trust and unjust enrichment. Punitive damages were barred on March 31. Breach of contract, RICO, false advertising, and antitrust were dismissed earlier. Two equitable claims left, with very large stakes attached.

Many entertaining moments in the trial. The donkey-trophy moment, where the judge held up a golden statue of a donkey’s backside and decided not to admit it. Musk’s pretrial email to Greg Brockman saying that “by the end of this week, you and Sam will be the most hated men in America.” Gonzalez Rogers scolding Musk twice from the bench. But don’t miss the important for the entertaining.

The Procedural Twist

Here’s the thing many articles aren’t explaining well. The jury’s verdict in this case is advisory only. Gonzalez Rogers will make the final call on liability and on remedies, and she is not required to follow what the jury says.

Why? Because both surviving claims sound in equity. Breach of charitable trust and unjust enrichment (at least as pleaded here, where Musk is seeking disgorgement rather than money damages traceable to his pocket) are equitable claims. The Seventh Amendment right to a binding jury trial doesn’t attach to equitable claims. It attaches to “Suits at common law.” Under Federal Rule of Civil Procedure 39(c)(1), in an action not triable of right by a jury, the court “may try any issue with an advisory jury.” That’s what Gonzalez Rogers did. Nine jurors, six women and three men, no alternates, and a verdict that the judge can adopt, modify, or set aside entirely.

Judges typically go along with their advisory juries, but they don’t have to. Duquesne University law professor Steven Baicker-McKee told CNBC that judges usually empanel advisory juries when they “want the community judgment of the jurors or they want ‘cover’ in a highly visible case.” Gonzalez Rogers has presided over Epic v. Apple and other high-visibility tech matters. She knows what she is doing.

When you see headlines or posts saying Musk lost. Not really. At least not yet. Nothing is final until Gonzalez Rogers issues her own ruling. So now the most interesting point, to me at least, begins.

The Frontier LLM Community Is a Small, Tangled Family

Worth pausing here on something most readers don’t appreciate. The major AI labs were largely founded by the same people, working together, until they weren’t.

OpenAI was incorporated in December 2015 by eleven co-founders including Musk, Altman, Brockman, Ilya Sutskever, John Schulman, Wojciech Zaremba, and Andrej Karpathy. Now, stay with me for a minute -- it gets bumpy. Karpathy left for Tesla, came back to OpenAI, then left again. Sutskever, who voted to fire Altman in November 2023, departed in May 2024 to start Safe Superintelligence. Schulman left OpenAI for Anthropic in August 2024. Dario and Daniela Amodei, both former OpenAI executives, left in 2021 over safety disagreements and founded Anthropic. Musk left OpenAI’s board in 2018, founded xAI in 2023, and is now the plaintiff in this case. And in the middle of the November 2023 board crisis, OpenAI’s own board reportedly contacted Dario Amodei about replacing Altman and proposed merging OpenAI with Anthropic. He declined.

Layer onto that the ‘Musk-wanted-OpenAI’ thread, which is genuinely material to the case. OpenAI’s defense made the salient point that Musk himself proposed in 2017 that OpenAI become a for-profit entity, and merge into Tesla, and that he left when his fellow founders declined. Let me say that again -- Musk himself proposed a for-profit conversion. Then in February 2026, Musk made an unsolicited $97.4 billion offer to buy OpenAI. Altman publicly mocked it with a counter-offer to buy X for $9.74 billion. That history is part of why OpenAI’s lawyers characterize this lawsuit as “an extension of a Silicon Valley turf war” rather than charitable-trust enforcement.

In this case, charitable-trust law is being wielded more as a weapon than a regulatory channel. Every frontier-AI corporate structure has former colleagues, ex-board members, and rejected acquirers in its history. Any one of them could sue. Gonzalez Rogers is being asked to evaluate a tangled, difficult history and is the same template a lot of mission-driven companies, foundations, and research institutions are using or considering. The ripple effect isn’t only in AI.

The Remedies Phase

The remedies phase began, running concurrently with deliberations. If Gonzalez Rogers finds liability, she is looking at four possible remedies, each of which would be a first.

Unwinding the for-profit conversion. Musk has asked the court to undo OpenAI’s nonprofit-to-PBC restructuring entirely. As an operational matter, this is a nightmare. IP, talent, compute commitments, customer contracts, and a $13 billion Microsoft investment have all migrated to the for-profit. Reversing that requires disentangling a working AI company from a corporate skeleton that was redesigned around it. No federal court has ever attempted this.

Removing Altman and Brockman. Musk has asked the court to order their removal from leadership. Federal courts do sometimes order officer removals as equitable relief in trust and corporate-fiduciary cases. Not for the CEO of a leading frontier AI lab in the middle of an IPO runway.

Severing the Microsoft relationship. Musk also accused Microsoft of aiding and abetting the alleged breach. If the court agrees, the remedy could affect Microsoft’s stake. That ripples outward to every hyperscaler-lab partnership. Google’s investment in Anthropic, Amazon’s $33 billion commitment, the Nvidia-Microsoft-OpenAI circular investment structure that has drawn analyst skepticism for the last year. None of those are identical to the Microsoft-OpenAI relationship, but a finding that one of them aided and abetted a breach of charitable trust shifts the risk considerations for all of them. The circular relationships here are dizzying.

Disgorgement. Musk asked for up to $180 billion paid from the for-profit back to the nonprofit. Gonzalez Rogers has seemed unlikely to buy the math behind that. The other end of the range, from Darrow AI, is roughly $20–38 million, which is approximately what Musk contributed in the first place. From $20 billion, the $180 billion -- that is what you call a range.

Any of these remedies, by itself, would be a first for the AI industry. And some combination of them is now genuinely possible.

This Is Bigger Than OpenAI

The OpenAI conversion was a template. Hybrid corporate structures with foundation overlays, capped-profit subsidiaries, mission-bound boards, and special governance instruments all owe something to the OpenAI experiment. Anthropic was structured as a PBC from inception in 2021, with the Long-Term Benefit Trust added in 2023 specifically to address governance challenges Anthropic’s founders saw at OpenAI. xAI is a for-profit. Mistral, Cohere, and others have their own variations. All the LLM frontier founders will be watching whatever Gonzalez Rogers decides about converting a charitable mission into for-profit equity.

This isn’t only an AI issue. Hospital systems with charitable origins are spinning out for-profit subsidiaries. Research universities are monetizing IP through commercial arms. Foundations are operating PBCs alongside their grant-making. Each of those starts with the legal premise being tested in this courtroom — that you can convert charitable purpose into commercial equity without breaching the underlying trust. If Gonzalez Rogers rules that OpenAI breached its charitable trust, it could have wide-ranging consequences.

And California Attorney General Rob Bonta has been watching from the side of the courtroom. He publicly reminded OpenAI that its assets are “irrevocably dedicated” to charitable purposes. A win for Musk puts state AG charitable-trust enforcement in the spotlight for every state with a charitable-trust statute.

There’s a board-governance lesson underneath, too. The November 2023 Altman firing-and-rehiring surfaced internal documents about how the OpenAI board actually functioned. And this takes us back to data governance. Document discipline, board minutes, committee deliberations, internal Slack — all of it is going to look like the Brockman journal in some future case. (Yes, callback to Part I. Couldn’t help myself.)

What to Watch For

Three things, in order of importance.

1. The jury verdict and judicial verdict. The jury found for Altman, Brockman and OpenAI. Now, start the clock for the judge’s ruling. If she rules within days, that is a story. Likewise if she doesn’t enter her ruling for weeks, that signals she didn’t give much credence to the jury’s decision. The interval tells you something about how much weight she is giving the advisory jury.

2. Whether the remedy is structural or monetary. A disgorgement number, even a large one, is something OpenAI can absorb. But consider, unwinding the conversion or ordering leadership changes is a different category of harm altogether. The type of the remedy matters more than its dollar value in this case.

3. What the California AG does next. Bonta has been quiet but visible. If Gonzalez Rogers finds a breach of charitable trust and the AG follows up, the regulatory architecture for nonprofit-to-PBC conversions changes overnight.

Bottom Line

During the trial, gossip got the headlines. The procedural posture is going to make the law. And the law that gets made in this case, however it turns out, will have an impact on corporate governance for organizations across the AI sector and well beyond it.

Watch the remedies phase. The remedies phase is what actually matters in this case.

Editorial note: This is real-time analysis of an active trial. Whatever Judge Gonzalez Rogers does in the next few weeks may make parts of this piece look prescient or, alternatively, look silly. Read accordingly.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Misinformation about AI and client confidentiality is rampant. In conference hallways, bar association email lists, and CLE panels, the same myths keep surfacing. Yesterday I was speaking with a technologist and one of the top software engineers in the country. They were concerned about the confidentiality needs of attorneys. They understood the technology but had absorbed several of the same misconceptions circulating in the legal profession itself.

Small and solo firms—near and dear to my heart--can least afford to get this wrong. Some of these myths overstate the risk. Others understate it. All of them obscure the practical analysis lawyers actually need to perform in order to make the best decision for your practice and your needs.

This article is a companion to Is It Safe to Put Confidential Information in AI Tools?, which provides a full vendor comparison chart, privilege analysis, and practical framework. Here, we isolate and correct nine common misconceptions. A glossary of technical terms used in this article appears at the end.

Myth 1: “AI Tools Train on Everything You Type.”

Reality: It depends entirely on the product tier and your settings.

This myth persists because it was once partially true—and remains true for free-tier products. When ChatGPT launched in late 2022, the default setting for all users was to permit OpenAI to use conversations for model training. That default created the impression, now hardened into ‘received wisdom,’ that every AI tool ingests and learns from everything you submit.

AI models have evolved since that time. At the paid individual tier, every major platform—Claude, ChatGPT, Gemini, and Microsoft Copilot—offers a toggle to opt out of model training. At the enterprise tier, training on customer data is off by default and governed by a Data Processing Agreement. The critical distinction is between a UI toggle, which a vendor can change unilaterally, and a contractual commitment, which they cannot. Enterprise Data Protection Agreements (DPAs) provide the latter. If you’re using the toggle, check routinely to verify that you have privacy settings as high as possible.

Myth 2: “Using AI Waives Attorney-Client Privilege.”

Reality: Trial courts are addressing this — and the door is wide open to using AI tools when properly configured.

This myth likely draws from United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y. Feb. 17, 2026), in which Judge Rakoff held that documents Heppner generated using a consumer version of Claude were not protected because (1) Claude is not an attorney and so could not form an attorney-client relationship; (2) Anthropic’s consumer privacy policy gave Heppner no reasonable expectation of confidentiality; and (3) Heppner acted on his own, not at counsel’s direction, defeating work product protection.

Two things need to be said about Heppner. First, it is a single district court opinion—persuasive authority at best, binding on no one outside the Southern District of New York. It has not been adopted by any circuit court. Moreover, two subsequent decisions have pushed back on its broader implications. In Warner v. Gilbarco, Inc. (E.D. Mich. Feb. 10, 2026), Magistrate Judge Patti denied a motion to compel a pro se plaintiff’s AI-assisted litigation materials, holding that generative AI platforms are “tools, not persons” and that using them to assist in drafting is no more a waiver of work product protection than using a word processor or a legal research database.

In Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB (D. Colo. Mar. 30, 2026), the court similarly held that a pro se litigant’s AI-assisted materials qualified for work product protection under FRCP 26(b)(3), while also requiring that any AI tool used to process confidential discovery material be subject to contractual safeguards—including prohibitions on training, restrictions on onward disclosure, and the ability to delete data on request. Second, the holding turned entirely on the absence of reasonable precautions. The court explicitly left open that counsel-directed AI use on a platform with contractual confidentiality protections could yield a different result.

There is currently no case that stands for the proposition that AI waives privilege. What we do know is that using a free consumer tool with no privacy controls and no attorney involvement almost certainly waives privilege — which is exactly what privilege law has always required. The doctrine has never protected careless sharing of protected information, regardless of the technology involved.

Myth 3: “Legal-Specific AI Tools Are Inherently Safer Than General-Purpose Ones.”

Reality: Safety comes from security architecture and contractual commitments, not from the label on the product.

There is a comforting assumption in some corners of the profession that tools built specifically for lawyers—like Harvey—are categorically safer than general-purpose tools like Claude or ChatGPT. Harvey’s security posture is strong: SOC 2 Type II, ISO 27001, AES-256 encryption, no training on customer data by default, and a DPA included with the product.

But every general-purpose AI tool in the market offers the same certifications at enterprise tier. Claude, ChatGPT, Gemini, and Microsoft Copilot all hold SOC 2 Type II and ISO 27001 certification. They all offer AES-256 encryption in transit and at rest. They all provide enterprise DPAs with contractual no-training commitments. The companion article includes a full comparison chart. The protections flow from the vendor’s infrastructure and agreements, not from whether the marketing materials mention “legal.”

Myth 4: “My Cloud DMS Is Secure, but AI Isn’t.”

Reality: AI tools and cloud DMS platforms share the same infrastructure, encryption, and vendor access model.

This may be the most consequential myth on the list, because it underlies most firm-level AI prohibitions. The reasoning goes: “We trust NetDocuments (or Clio, or iManage, or Microsoft 365) with client files, but AI is different, and we cannot trust it.”

It is worth examining what, exactly, is supposed to be different. Your document management system (DMS) stores client documents on third-party cloud servers. So does AI. Your DMS encrypts data in transit with TLS and at rest with AES-256. So does AI. Your DMS vendor’s support engineers can access your data for maintenance and troubleshooting purposes. So can AI vendor employees, within defined and, depending on your set-up, contractually bounded safety review processes. Hopefully your DMS vendor holds SOC 2 Type II and ISO 27001. So does every major AI platform.

The reason we as lawyers are comfortable with cloud DMS is that we’ve evaluated the vendor, configured the settings, and signed a DPA. And frankly, we’re comfortable because these applications are so common as to be standardly used in law practice today. It’s widely accepted that your email lives in the cloud. And your documents are stored and categorized in the cloud.

AI is new and not taken for granted like DMS applications. There are differences between AI apps and DMS apps, but with training turned off, and privacy settings turned on, those differences are not so wide.

Myth 5: “AI Vendors Can Read My Prompts Whenever They Want.”

Reality: Human review is limited by purpose, bounded by contract at enterprise tier, and structurally close to vendor access at your DMS or email provider.

Every major AI vendor reserves the right, in its terms of service, to allow human review of prompts for safety and abuse detection. This is true. It is also true of your email provider, your cloud storage vendor, and your practice management platform. Microsoft’s support engineers can access your Exchange Online mailbox under defined circumstances. Google’s trust and safety team can review your Workspace content. NetDocuments’ operations staff can access your document repository.

At the enterprise tier, AI vendor access is governed by a DPA that limits the purposes, scope, and duration of human review. The contractual protections mirror what cloud DMS vendors provide. At the paid individual tier, protections are thinner—terms of service rather than negotiated agreements—which is why the companion article recommends enterprise tier for any firm handling sensitive client data at scale.

The myth gains traction when we imagine AI vendor employees casually reading our prompts over coffee. The reality is that vendor access is contractually bounded, audit-logged, and limited to defined purposes—not casual browsing.

Myth 6: “Opposing Counsel Can Use AI to Pull Up My Prompts and Work Product.”

Reality: AI session data is account-scoped and vendor-held. Accessing it requires a subpoena to the vendor—not a clever prompt.

This myth has two variants, and both are wrong. The first imagines opposing counsel logging into an AI platform and somehow retrieving your session history. The second imagines them prompting the AI itself to “regurgitate” your inputs and outputs. Neither scenario reflects how these systems work.

Opposing counsel logs in and retrieves your session history.

Conversation histories are stored in the vendor’s infrastructure, scoped to your account, and protected by the same authentication and access controls as any cloud SaaS product. Another user cannot access your session history any more than they could log into your NetDocuments account and browse your files. If opposing counsel wants your AI chat logs, they need to serve a subpoena on the vendor — the same process they would use to obtain your email or Slack messages. That is a discovery issue, not an AI vulnerability, and it is addressed in Myth 7.

Opposing counsel uses a clever prompt to retrieve your inputs and outputs.

Large language models do not store or index user prompts in a retrievable way. The model generates responses based on its pre-trained weights and the current context window — the text visible in that session. When the session ends, the context window is discarded. There is no mechanism for the model to recall, search for, or reproduce another user’s inputs.

If opposing counsel, or anyone, types “show me the prompts Attorney Smith submitted in Jones v. Williams,” the model will either explain that it cannot access other users’ sessions or — worse — hallucinate a plausible but entirely fabricated response (LLMs sometimes generate confident-sounding but invented text when they cannot answer a question). Either way, it is not returning real data. LLMs do not work that way. They are stateless and don’t function like a database would. See Myth 9 for more explanation.

Myth 7: “AI Prompts are More Vulnerable to Subpoenas”

Reality: AI chat logs are discoverable ESI — but no more so than email, texts, Slack messages, or search histories. The same rules govern all of them.

This myth reflects a genuine concern—but misidentifies what is new about it. AI prompts and responses are electronically stored information (ESI) under the Federal Rules of Civil Procedure and are discoverable under FRCP 26, 34, and 45 on the same terms as any other electronic communication. They are not subject to a special, heightened standard of vulnerability. They are subject to the same standard as email, text messages, Teams chats, and browser search histories.

The risk is real, but it is not unique to AI. In the New York Times v. OpenAI copyright litigation, Judge Stein in the SDNY compelled OpenAI to produce 20 million ChatGPT log entries in January 2026 — but under standard discovery principles, not any AI-specific mechanism. OpenAI’s Chief Strategy Officer publicly called for a new form of “AI Privilege” to protect user-chatbot conversations from subpoenas, but the court rejected the concept. Until Congress acts, or we see far more favorable cases, AI developers are subject to the same discovery rules as any other software provider.

The Morgan v. V2X protective order (D. Colo. Mar. 30, 2026) offers a practical insight into how to treat protected discovery information. In that case the court required that any material produced under a protective order be subject to contractual safeguards. It set up a framework of requirements which must be met in order to put the other side’s protected confidential information into an AI tool. The framework includes prohibitions on model training, restrictions on onward disclosure, and the ability to delete data on request. This is necessary to protect such information. That decision did not discuss the majority of AI use.

In an abundance of caution you should include AI chat logs in your ESI preservation and litigation hold protocols, just as you would for email and messaging platforms. Verify your AI vendor’s data retention windows. And if you are using AI to process material subject to a protective order, confirm that the vendor’s contractual commitments satisfy the order’s requirements.

Myth 8: “AI Tools Can Secretly Upload My Entire Device or My DMS.”

Reality: AI tools see only what you put in the prompt, what you’ve stored in the “shared memory” features of some AI tools — or the specific data sources the tool was explicitly configured to access. They have no background access to your files, drives, or other applications.

This myth can drive many firm-level AI policies. The fear is that downloading an AI desktop app, installing a browser extension, or signing into a copilot somehow gives the AI access to everything on your machine — every email in your Outlook, every document in your DMS, every client file on your hard drive. The reality is far more bounded.

AI tools come in three architectural categories, and each is limited to what its configuration explicitly permits:

• Standalone web and desktop AI tools (the consumer or paid Claude, ChatGPT, Gemini, or Copilot Chat app). These see only what you type or paste into the prompt window, plus any file you explicitly upload. They have no read access to your local drive, your other applications, your DMS, or your email. Closing the browser tab or quitting the app ends the session.

• Integrated AI tools (Microsoft 365 Copilot tied to your tenant, Google Workspace AI features tied to your Workspace account, IDE-integrated coding assistants). These see the data sources the integration was configured to access — by you or your firm’s administrator. Microsoft 365 Copilot can see your Exchange Online mailbox and your SharePoint documents because your tenant administrator enabled that scope. It cannot see your personal files, your iManage DMS (unless separately integrated), or applications outside the Microsoft 365 boundary.

• Browser extensions and meeting bots. Both operate within the permissions you (or your IT admin) granted at install, generally. Browser extensions see the active tabs you use with the extension. Browser extensions are generally less privacy-friendly than a chat interface with privacy settings on. Search requests and results are more likely to be retained and used to help train LLMs. Meeting transcription bots see the meeting they were invited to. Use caution when you are in a meeting someone else organized with a meeting transcription bot in it. You are relying on the privacy settings the meeting organizer set. Some have as a default that they will capture and use meeting information. However, neither of these tools rummage through your file system, your DMS, or your applications. The data they see is the data you (or your administrator) explicitly put within their reach.

In other words, AI tool risk is not “the AI is watching everything.” It is “the AI is doing what your integration says it can do, with the data your integration gives it access to.” That makes the diligence question concrete and answerable — what tool, what tier, what integration scope, what DPA? The same diligence you already apply to cloud DMS and email applies here. Vague fear of background access is not the worry when using reputable AI tools.

The one caveat is AI agents. You can unintentionally grant greater access to an AI agent--and thereby every app it integrates with -- that will allow it to access your local and cloud-based systems. Be extra cautious when using AI Agents, and follow these best practices.

Myth 9: “I Put Certain Info into AI, and It Will Remember It and Spit It Back Out Someday.”

Reality: AI models are stateless by default. Persistence features exist on some platforms but are user-controlled, account-scoped, and distinct from model training.

Each AI conversation starts from zero. The model carries no memory of prior sessions unless you have explicitly enabled a persistence (memory) feature. When a session ends, your input exists in only two places: (1) the vendor’s server logs, subject to the retention policy and DPA, and (2) the model’s weights—but only if your data was used for training. If training is off (paid tier with toggle disabled, or enterprise tier with contractual no-training), your input never influences the model at all. It is processed, a response is generated, and the content is retained only as a server log subject to the vendor’s documented retention window.

Some vendors do offer optional persistence features, and lawyers should understand how they work. For example, ChatGPT’s Memory feature allows the tool to save high-level preferences and details across sessions—your name, tone preferences, project context—and reference past conversations to personalize responses. Memories are stored separately from chat history, meaning deleting a chat does not delete saved memories. Memory can be turned off entirely, and individual memories can be reviewed and deleted in settings. Importantly, OpenAI states that memories and workspace information are excluded from model training.

Google’s Gemini takes a different approach through its Gemini Apps Activity setting. When “Keep Activity” is turned on, Google saves conversations to your account, may use them to personalize future responses, and reserves the right to have human reviewers assess a subset of chats—with reviewed conversations retained for up to three years. When turned off, conversations are still held for up to 72 hours for service delivery and security, but are not reviewed or used for model improvement. The distinction is that “off” provides materially stronger privacy, and lawyers using Gemini for anything involving client data should verify this setting.

Note: Verify that this information about retention periods and human review is still accurate. AI vendors change their terms of service and privacy policies as quickly as some people change their shoes.

Even in the worst case — free tier, training enabled, no opt-out — the likelihood of a model reproducing a specific privileged communication verbatim is astronomically low. Model training adjusts statistical weights (internal numerical values that encode everything a model has learned during training) across billions of internal parameters (internal numerical values) using aggregated data. It does not memorize and replay individual inputs. The AI safety literature treats verbatim memorization as an edge case, not a typical, likely, or systemic exposure. But it is best practice to use a tier where training is contractually off, verify the retention period, disable optional memory features if your use case involves client data, and then the risks shrink exponentially.

Subscribe now

Glossary of Technical Terms

Context window. The text a model can “see” during a single conversation. This includes everything you have typed in the current session and the model’s responses. When a session ends, the context window is discarded. The model does not carry it forward.

Data Processing Agreement (DPA). A legally binding contract between a data controller (the law firm) and a data processor (the AI vendor) that governs how personal and confidential data is handled. Unlike a terms-of-service toggle, a DPA is a contractual commitment that the vendor cannot change unilaterally. Enterprise-tier DPAs typically include commitments on data use restrictions, no-training clauses, data retention and deletion, breach notification, and audit rights.

Edge case. A scenario that occurs only under unusual or extreme conditions. In AI safety research, verbatim memorization of training data is considered an edge case—theoretically possible but vanishingly rare in practice, especially with modern training techniques designed to prevent it.

Inference. The process by which a trained AI model generates a response to a prompt. During inference, the model applies its pre-existing knowledge (stored in its weights) to produce output. No learning occurs during inference—the model’s weights do not change.

Parameters. The numerical values inside a model that determine how it processes language and generates responses. Large language models contain billions of parameters. During training, these values are adjusted using large datasets. During inference (when you use the tool), they are fixed.

Stateless. A system that does not retain information between interactions. AI models are stateless by default: each new session begins with no memory of prior sessions. Any persistence (such as ChatGPT’s Memory feature) is a separate, optional layer built on top of the model, not a property of the model itself.

Weights. The internal numerical values that encode everything a model has learned during training. When people say a model has been “trained on” data, they mean the data was used to adjust these weights. Once training is complete, the weights are fixed. When training on your data is disabled, your inputs do not influence the weights and cannot become part of the model’s knowledge.

The Common Thread

Every myth on this list shares a common root: a misunderstanding, or lack of awareness of, how AI tools work. The technology behind the technology.

ABA Formal Opinion 477R requires that lawyers take reasonable precautions with electronic communications—including vetting vendors and understanding data handling. ABA Formal Opinion 512 applies that same framework to AI tools. Neither opinion prohibits AI use. Both require informed, diligent adoption.

The myths persist because they offer simple answers to a question that requires nuance. The real answer—that AI tools are safe when properly vetted, configured, and governed—is less dramatic but far more useful. The law in this area is still developing. Heppner, Gilbarco, and Morgan are district court opinions, not circuit authority, and the courts are still working out how existing privilege and work product doctrines apply to AI-assisted legal work. So far, the trajectory shows that courts are applying existing frameworks to new technology, not creating AI-specific exceptions.

For the full framework, vendor comparison chart, and practical checklist, see the companion articles.

Share AI For Lawyers

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

NOTE -- Nothing in this article is to be construed as legal advice. This article is for informational purposes only and consists purely of the author’s personal opinion. If you have legal questions or concerns, contact a legal professional as soon as possible.

On March 30, 2026, a federal magistrate judge in Colorado issued an order in an employment discrimination case most lawyers will never read. They should — but not for the reasons most of the commentary has been suggesting. Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB (D. Colo. Mar. 30, 2026), is one of the most thoughtful federal AI decisions issued so far this year. It is also narrower than it is being read to be.

In more than one venue, commentators have turned Magistrate Judge Maritza Dominguez Braswell’s order into a universal AI governance doctrine. It isn’t. What she decided was a discovery dispute about protective-order language in a case where a pro se plaintiff wanted to use public AI tools on documents the corporate defendant had produced under a confidentiality order. Judge Braswell’s reasoning and framework are intelligent and elegant. The reasoning deserves careful attention. But let’s be clear on what Braswell actually held and what it actually means for your use of AI.

Morgan as the Case Study

Background

The underlying case is an employment discrimination lawsuit in the District of Colorado. Archie Morgan is a pro se plaintiff suing his employer V2X. Both sides used AI in their litigation work. V2X has enterprise AI tools. Morgan, representing himself, uses public ones. The AI dispute surfaced when V2X moved to restrict Morgan’s use of public AI platforms — a restriction Morgan argued would create an unfair “technological gap” between a self-represented litigant and a well-funded corporate defendant with proprietary AI and cloud-based systems of its own. V2X also moved to compel Morgan to disclose which tools he was using.

Judge Braswell — who co-chairs her district’s AI Committee, co-founded the Judicial AI Consortium, is on Sedona Conference’s working group (WG13) regarding AI, and is genuinely knowledgeable in this material — did not default to either side’s proposed language. She wrote her own. Before uploading confidential information covered by the protective order to any AI platform, she held, the provider must be contractually prohibited from:

• Storing or using inputs to train or improve the model;

• Disclosing inputs to third parties (except where essential to service delivery, and then only on terms no less protective than the protective order itself); and

• Retaining inputs beyond what is necessary.

She also required that the vendor contractually afford the party the ability to delete all confidential information upon request, and that the party retain written documentation of the contractual protections. And she ordered Morgan to disclose the name of the AI tool he was using, finding that tool selection alone does not reveal mental impressions or legal strategy absent a specific factual record.

That is the entire order. A set of contract requirements and a disclosure obligation, tied to information produced under a protective order. On its face, thoughtful but narrow

What the Judge Decided

Commentary on Morgan has slotted it alongside United States v. Heppner, No. 25-cr-00503 (S.D.N.Y. Feb. 17, 2026), and Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026). That framing puts the three cases into a single bucket labeled “AI and privilege” and treats Braswell as though she were answering the same question as Judge Rakoff and Judge Patti. She wasn’t.

An Everlaw article discussing Morgan noted the procedural posture as being material under a protective order being submitted into an AI tool, but then said “the court . . . established a precise set of contractual must-haves for any legal professional looking to integrate AI into their workflow.” Clio went further, headlining its post “Courts Are Starting to Pick AI Tool Winners” and characterizing the order as “a new standard for AI use in litigation”. Respectfully, both are overstatements about both the holding and its reach. Heppner and Gilbarco both asked whether a litigant's use of AI waived existing legal protections — traditional doctrinal questions applied to a new technology. The question Braswell answered in Morgan was different and more narrow: in a discovery dispute, what should a protective order say about a pro se plaintiff's use of public AI tools on materials the corporate defendant produced under a confidentiality designation? That is a data governance question, not a privilege question.

As a data governance nerd (or maybe Diva?), this is the same type of question every data protection officer, a cloud governance lead, or a vendor risk analyst asks about any third-party processor. What happens to the data once it leaves my environment? Who can see it? How long does it persist? What rights does the vendor have to use it for their own purposes? Privacy professionals and information governance lawyers have been asking these questions for decades. However, they are more important now, thanks to widespread AI use.

The Applicability of the Order

Braswell decided two things, one of them quite narrow

1. Work product privilege may apply to an advocate’s AI tool use;

2. A litigant bound by a protective order may not use AI tools on materials covered by that order unless the AI vendor meets her contract-based standard.

That’s it.

She did not hold that all lawyers everywhere must use only AI tools meeting that standard. She did not hold that a solo practitioner using ChatGPT or Claude on legal work is violating Rule 1.6. She did not hold that consumer AI is per se incompatible with confidentiality obligations. She resolved a discovery dispute about protective order language in a specific case with a specific fact pattern.

Granted, Judge Braswell’s reasoning is attractive. The standard is clean, sensible, and maps to real data governance principles. It should inform how lawyers think about AI tool selection generally. But “should inform” and “is binding authority” are different things.

What Judge Braswell no doubt understood was that different data should be treated differently.

Four Data Categories, Four Enforceability Tiers

Data governance is everything with AI implementation. One of the first questions with AI Governance must be “Whose data is at risk, what is the risk, and what can I enforce?” Four categories of data behave differently, and the required precaution change accordingly.

Your own non-regulated information. A pro se litigant using ChatGPT to analyze her own employment history and draft her own complaint. The information is hers; the harm from any leakage runs to her and only her. She is entitled to make her own decision. Braswell’s rule would be overbroad in this category — and she didn’t purport to apply it here.

Attorney-client privileged communications. The Heppner fact pattern. Here the harm is potentially catastrophic and irreversible. Judge Rakoff’s reasoning raises the question — left open in Heppner itself — of whether feeding lawyer-provided information into a consumer AI tool risks waiving privilege over the original attorney-client communications. If that reasoning is extended in future cases, the three-part standard may actually be insufficient in this category.

Regulated data categories. PHI under HIPAA, nonpublic personal information under GLBA, personal data under state privacy laws. Rule-governed territory. The harm is statutory. The precaution is mandatory, independent of Morgan.

Third-party confidential information under a protective order or similar confidentiality obligation. This is the Morgan fact pattern. The information was V2X’s, produced to Morgan under a confidentiality agreement. Morgan uploading it into a training-enabled AI tool would unravel the bargain without V2X’s consent. The harm is concrete, the non-consenting party bears it, and Braswell’s rule is proportionate.

The Enforceability Spectrum

Once you know which category your data falls in, you need to know which tier of contractual protection the tool actually offers. Tool choice is about whether the protection is enforceable, provable, and durable. That’s not necessarily determined by brand or cost.

A few concrete examples, as of this writing (vendor terms change; verify before relying):

• OpenAI Enterprise and OpenAI API commercial tier, Harvey, Anthropic commercial API and enterprise agreements: default no-training on customer data, contractually committed. Strong tier.

• ChatGPT with the “improve the model for everyone” toggled off: enforceable representation, but dependent on consumer terms of service. Medium tier for most use; handle privileged information with care.

• A free AI tool, or a browser extension AI tool with no “privacy mode” setting and no visible contract: weak. Do not use with client data.

You should always know which tier you are in, and keep in mind what your firm’s AI policy permits.

Best Practices

Keeping in mind, we only have district court decisions regarding AI at this point. Reading those decisions, six best practices emerge.

1. Match the tier to the data category. Strong-tier tools are required for third-party confidential information under a protective order, attorney-client privileged communications, and regulated data (PHI, NPI, CUI). Medium-tier tools are acceptable for general research, brainstorming, and non-sensitive drafting. Weak-tier tools belong nowhere near client data.

2. Audit every AI tool currently in use. Document where the no-training, no-sharing, and no-retention protections are — enterprise terms, MSA, addendum, DPA, or toggle plus vendor representation. Maintain records of what tier each tool occupies and the evidence supporting that placement.

3. Review your AI policy to map tier to data category. Your policy should expressly address the fact that different categories of data, with different confidentiality needs exist.

4. Build the spectrum into procurement. Evaluation starts with data processing terms, not features. The right question is not “does the vendor offer a privacy toggle” but “is the toggle anchored in enforceable language, can we prove its state at the time of use, and is the remedy adequate for the data category”.

5. Counsel should direct AI use whenever the materials may be sought in discovery. The gap between Heppner and Warner turned in part on whether counsel directed the use

6. Never use a weak-tier tool on client data, regardless of convenience. A browser extension with a “privacy mode” setting and no visible contract is not a defensible choice, and no AI policy should permit it.

The 60-Second Checklist

Before pasting client data into any AI tool, confirm:

• Whose data is it? (Yours, the client’s, a third party’s under a protective order, or regulated?)

• What tier is the tool? (Strong, medium-strong, medium, or weak?)

• Is the tier proportionate to the data sensitivity?

• Can you prove the protection state today?

• Did counsel direct the use?

If you cannot answer all five, stop. Either move the work to a different tool or build the record before you proceed.

Share AI For Lawyers

The Bottom Line

Braswell decided a narrow discovery dispute carefully, and intelligently. Braswell’s order illuminated a principle that was already sound. AI tools that ingest, share, or retain user data are not safe for information held under a confidentiality duty owed to others. She set out a framework for when users can put third-party confidential information into an AI tool. It has limited applicability to a lawyer’s own work outside of that factual and procedural posture.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Musk v. Altman Can Teach Lawyers A Lot About the “Just In Case” Rule of Document Retention

The Trial Started April 27, 2026

Elon Musk sued Sam Altman and OpenAI for actions that go back to the humble, non-profit beginnings of OpenAI. The filings contain some interesting, flashy gossip on the surface. But beneath the flashy gossip is a serious lesson.

The trial that started this week in Oakland is a vivid illustration of what happens when sophisticated organizations keep everything. Exhibits range from merely embarrassing to damaging — Greg Brockman’s 2017 personal journal, Elon Musk’s 2016 email calling Jeff Bezos “a bit of a tool,” internal communications about how to “control the narrative” around an investigation. These are all in the case for one reason-- nobody disposed of them.

Let’s be honest. Law firms keep more, for longer, with less discipline than the Musk v. Altman defendants. Call it the “Just In Case” Rule of document retention and data governance. If your firm subscribes to that, this article shows you why you should rethink that.

What The Discovery Has Actually Produced

Hundreds of unsealed filings in Musk v. Altman have pried open the internal information practices of OpenAI, Microsoft, Meta, and Tesla. The court’s January 15, 2026 summary judgment order (docket; SJ order, 1/15/26) quotes directly from a September 2017 Brockman journal entry:

“This is the only chance we have to get out from Elon. … Financially, what will take me to $1B?”

An unsealed February 3, 2025 text exchange shows Mark Zuckerberg telling Musk that Meta’s teams were,

“on alert to take down content doxxing or threatening the people on your team” working on DOGE.

Internal OpenAI communications from March 2024 show then-communications chief of OpenAI, Hannah Wong, describing efforts to “control the narrative” around the WilmerHale investigation summary.

None of these were created as corporate records. Yet they are now central exhibits — preserved, accessible, and produced because they were relevant under Federal Rule of Civil Procedure 26 and within the corporation’s possession, custody, or control under Rule 34, That is the lesson. Discovery turns on relevance and on whether the producing party had the legal right or practical ability to obtain the material. Courts apply that test functionally. In re NTL, Inc. Securities Litigation, 244 F.R.D. 179 (S.D.N.Y. 2007). Where the corporation does not have control, Rule 45 third-party subpoenas reach the rest.

No governance lever makes existing relevant material vanish once litigation is reasonably anticipated. There is one lever that genuinely reduces what exists to be discovered, and it operates entirely before any preservation duty attaches--defensible disposition under a written retention schedule. Yep, part of one of my favorite topics: Data Governance.

Why This Is A Law Firm Problem

The instinct in most firms is to keep everything. Closed matter files, drafts, internal memos, deposition prep, conflict-check workpapers, engagement letters, billing narratives, KM databases, marketing CRMs — and now AI-tool outputs. Copilot drafts, transcription archives, redline histories, intake-bot logs. The rationales for keeping all of it are familiar: malpractice tail risk, future citation, fee disputes, the possibility a former client will ask for something. None justifies indefinite retention. Most justify defined retention with documented disposition at the end of it.

Three reasons the law firm exposure is worse than the Musk v. Altman defendants’:

Volume and surface area. Firms hold work product, strategic thinking, candid attorney communications, and client confidences for hundreds or thousands of matters at once. Each matter is its own discovery and breach surface.

Confidentiality runs indefinitely. ABA Model Rule 1.6 applies to client information after the representation ends, with no expiration. Indefinite retention extends the duration of that confidentiality risk. Every additional year a closed file sits on a server is another year it can be breached or subpoenaed.

Breach risk is asymmetric. When a tech company is breached, its own information is exposed. When a law firm is breached, the privileged information of dozens or hundreds of unrelated clients is exposed simultaneously. The ABA’s 2024 Cybersecurity TechReport and the steady cadence of firm ransomware incidents (Mossack Fonseca, the 2023 Orrick breach affecting hundreds of thousands of clients, the 2024 Houser LLP incident) drive the point home.

What the Rules Actually Permit

Ostensibly law firms cling to the “Just in Case” Rule mainly in fear of spoliation. We can all agree, however, that routine, good-faith disposition under a written schedule, applied consistently before any duty to preserve attaches, is not spoliation. The 2015 amendments to Federal Rule of Civil Procedure 37(e) tightened the spoliation framework. Sanctions for lost ESI now require that the party failed to take reasonable steps to preserve, that the information cannot be restored or replaced, and — for the most severe sanctions — that the party “acted with the intent to deprive another party of the information’s use in the litigation.” Negligence and even gross negligence will not support an adverse inference. Applebaum v. Target Corp., 831 F.3d 740, 745 (6th Cir. 2016). Conformance in good faith to a valid retention policy, before any duty to preserve arises, does not itself demonstrate the requisite intent to obstruct or deprive. Arthur Andersen LLP v. United States, 544 U.S. 696 (2005).

The Sedona Conference Commentary on Legal Holds and Commentary on Information Governance treat consistent disposition under a written schedule as the foundation of defensible practice. That’s beautiful framing – the foundation of a defensible practice. The duty to preserve attaches when litigation is reasonably anticipated, and the schedule must be suspended at that point — but disposition that occurred before that point is protected. The professional rules are aligned, not in tension. I highly recommend reading the Sedona Commentary if you’re hanging on to files “just in case.”

ABA Formal Op. 471 (2015) addresses what lawyers owe clients on termination of representation, surveys the split between the entire-file and end-product approaches, and confirms that lawyers are not required to retain every file indefinitely. The Federal Civil Rules and the Professional Rules of Conduct all permit defensible disposition. The “just in case” instinct is a malpractice-aversion habit that can actually be turned against you if you let it supercede good data governance.

What a Defensible Schedule Looks Like — Pick Your Model

Most firms cannot realistically tag every document inside a matter file by sub-category and apply category-specific disposition. A schedule that requires that level of operational sophistication is one most firms will not actually follow. Two simpler models are defensible and implementable; pick the one that fits your needs and infrastructure.

Model 1 — Matter-level Disposition

The entire matter file is treated as a single bucket and disposed of on one schedule triggered by matter close, with a small number of carve-outs handled separately. This is the simpler model and works for solo, small-firm, and many mid-sized practices that do not have document-level tagging in their DMS.

Matter file (all working materials, drafts, correspondence, end-product, internal memos): Retain for the period set by the longest-required category that applies to the matter — typically seven to ten years from matter close for general civil and transactional work, longer for trusts and estates, longer where statute-of-repose or active malpractice exposure requires.

Trust account records (separate): Retain for the period your jurisdiction requires — five years under ABA Model Rule 1.15(a). Check your jurisdiction specifically.

Original client documents (separate): Wills, deeds, executed instruments, and other originals returned to the client at matter close. Get into the habit of returning originals promptly whenever possible. Otherwise, you must babysit them, which comes with a resource drag.

Email (separate, system-level): Three-year default retention on routine business email, with matter-relevant emails captured into the matter file at matter close.

Marketing and CRM (separate): Three years from last contact.

Model 2 — Two-tier Disposition

The matter file is split into two tiers, each with its own disposition schedule. This is the realistic outer limit of category-specific disposition for firms without sophisticated data governance infrastructure.

• End-product file (final pleadings, executed contracts, recorded instruments, opinion letters, closing binders): Retain for 7 - 10 years from matter close, or longer where the practice area requires; returned to the client at close where the entire-file approach applies.

• Working file (drafts, internal memos, attorney work product, correspondence, research, deposition prep, billing detail): Retain for 3 - 5 years from matter close, with carve-outs for matters under active or threatened malpractice claim, ongoing investigation, or open ethics issue.

• Trust account records (separate): As above — 5 years under Model Rule 1.15(a).

• Email (separate): Three-year default; matter-relevant communications migrated into the working file or end-product file based on substance. •

• Marketing, CRM, and AI-tool outputs (separate): As below.

Both models — the AI category AI-generated artifacts (copilot drafts, transcription archives, redline histories, intake-bot logs) are records subject to the same retention discipline as their human-authored equivalents, but live mostly outside the matter management system.

Maintain an inventory of AI tools in use, push vendor retention defaults into counsel’s hands (“indefinite” and “use for training” are the common defaults and both are unacceptable), and build AI accounts into legal-hold tooling.

Whichever model you pick, the schedule must be written, applied consistently, suspended on hold triggers, and audited. Selective enforcement — applied to associates but waived for the managing partner — is the signature failure mode.

When the Clock Starts

If agentic AI has taught me anything it’s that a schedule is only as good as its trigger. “Seven years from matter close” means nothing if “matter close” is undefined and as nebulous as morning fog. What that comes down to is pinning down in writing. Perhaps that sounds like an oversimplification, but here’s why it’s not. It shows a stable, consistent, measurable rule. You need that if you are going to defend a disposition decision years later.

1. Define “Matter Close” as a Specific Event. “Matter close” cannot be an instinct if it is to stand up to scrutiny. A workable definition combines final invoice issued and paid (or written off), closing letter sent to the client, file marked closed in the practice management system, and any retained originals returned. Always document the event with a date.

2. Trust Account Records run from termination of the representation, not matter close. ABA Model Rule 1.15(a) (many states have a similar rule) runs from termination. Usually the same date as matter close, but not always. Calendar these separately if needed.

3. Statutes of Limitation and Repose Run on Separate Clocks. A schedule that disposes of a matter file before the malpractice statute of repose has run is a problem. Build a practice-area lookup into the schedule and trigger disposition at the later of the schedule or the applicable repose period, whichever is longer. Once you close the matter, run both clocks in parallel: the schedule cadence (eg, seven years from matter close) and the repose period, which usually predates close (eg, five years from the act). You dispose of the file when the later of the two has run.

Best Practices

I love data governance, and if you have a hammer, well, everything is a nail. But objectively, a lot of this is just good ‘ole data governance and data hygiene.

1. Inventory what you retain and where it lives — including personal devices, AI tools, and vendor systems. You cannot govern what you cannot see.

2. Apply the schedule consistently across the firm, including to founders and named partners. Selective enforcement defeats the doctrine and raises your liability.

3. Suspend the schedule on legal hold and confirm holds reach AI accounts and personal devices. A schedule that doesn’t pause for litigation is not a defensible schedule.

4. Implement a written communications policy that addresses the use of personal devices and ephemeral messaging, including for senior lawyers.

5. Review vendor retention and AI-training defaults before procurement. Indefinite retention and “use for training” defaults are common, but unacceptable. These are legal issues that shouldn’t be left to the IT department.

6. Document disposition, holds, and policy updates. Undocumented practice is indefensible practice.

7. Calendar an annual review to address new tools, new practice areas, and new authorities. Boring advice, but it makes a big difference.

Bottom Line

Exponentially reduce the risk of that candid attorney communication by exercising good data governance. The work product, the strategic thinking, the candid attorney communications, and the client confidences sitting on your firm’s servers could turn out to be someone else’s exhibits in a future trial, or someone else’s data breach, someone else’s malpractice case, and someone else’s bar complaint. You’re keeping that file “just in case.” But really, it is unmanaged risk.

Records disposition is not the only factor at work in this case — channel discipline, privilege design, and platform governance also do real work — but it is the most concrete, the most actionable, and the most under-used.

Editorial note: this article is hardly dispositive or in-depth. Consider doing additional research.

Recommended Reading: Sedona Conference Commentary on Legal Holds, and Commentary on Information Governance

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

During the week of February 10, 2026, two federal district courts became the first to address whether attorney-client privilege and the work product doctrine protect materials generated using AI tools. The cases—United States v. Heppner (S.D.N.Y.) and Warner v. Gilbarco Inc. (E.D. Mich.)—reached different outcomes on different facts. Judge Rakoff, writing in Heppner, called it a “question of first impression nationwide.”

I’ve seen early commentary—including analysis from attorneys at large, well-respected firms—that has characterized these decisions as conflicting. Two courts, same day, opposite results. An emerging “split” or a trap for the unwary. That reading is understandable at first glance. It is also, on closer examination of the actual orders, mostly wrong. The cases involved materially different parties, different factual situations, different procedural postures, and different doctrinal questions. When the orders are read together the practical guidance for lawyers is remarkably consistent.

More AI decisions will follow; we can count on that. But these two are the starting point, and practitioners who understand these orders will be better positioned to protect their clients and themselves.

Here are the five most important takeaways.

1. AI Does Not Automatically Waive Privilege—But Carelessness Does

The single most important point from these decisions is that neither court held that using AI, standing alone, waives privilege, or work product protections. The question in both cases was whether the specific circumstances of the AI use destroyed protection.

In Heppner, a criminal defendant facing securities and wire fraud charges used Claude by Anthropic—to generate approximately 31 documents that were later seized by the FBI from his home. The defendant claimed these documents were privileged and work product. Judge Rakoff disagreed, but his reasoning was grounded in the specific facts. The defendant used a consumer tool with no contractual confidentiality protections, no privacy protections toggled on, and Anthropic’s privacy policy expressly permitted data collection, model training, and disclosure to third parties. Work product didn’t apply because the defendant’s own counsel did not direct him to use Claude.

The Court’s privilege analysis rested on three independent grounds. First, Claude is not an attorney—which, in Judge Rakoff’s words, “alone disposes of Heppner’s claim of privilege.” Second, the defendant had no reasonable expectation of confidentiality given Anthropic’s privacy policy. Third, the defendant did not communicate with Claude “for the purpose of obtaining legal advice”—Claude itself disclaims providing legal advice.

The Court held each of these grounds was independently sufficient. The court did not hold that AI tools are categorically incompatible with privilege. It held that this AI tool, used in this way, with these terms of service, provided no basis for a privilege claim. Change the facts—enterprise platform, contractual confidentiality protections, attorney direction—and the analysis changes with them.

Indeed, Judge Rakoff said as much. The court explicitly noted that had counsel directed Heppner to use Claude, the AI tool “might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.”

2. AI Tools Are “Tools, Not Persons”—And Gives Weight to the Work Product Analysis

Warner v. Gilbarco addressed a different question—whether working on litigation materials with an AI tool constitutes the kind of disclosure that waives work product protection. A pro se plaintiff—acting as her own counsel—used ChatGPT to prepare materials for her employment discrimination case. The defendant moved to compel production of her AI interactions, arguing that using a third-party AI tool was tantamount to sharing work product with a third party.

Judge Patti rejected that argument. The court’s core holding was that “ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background.” This matters because work product protection, unlike attorney-client privilege, can only be waived by disclosure to an adversary or someone likely to share information with an adversary. An AI vendor is neither. Using an AI tool to prepare litigation materials was, in the court’s analysis, no different from using any other tool—the work product remains protected because it was never disclosed to an opponent.

Notably this is the stronger doctrinal argument for protecting AI-assisted legal work, and it is the one many attorneys seem to struggle to internalize. Yes, privilege is fragile—voluntary disclosure to any third party can waive it. But work product is more durable—only adversary disclosure triggers waiver. For lawyers using AI in litigation, the work product doctrine is the more reliable shield, and Warner is the first court to say so explicitly.

3. A Pro Se Plaintiff Is Not in the Same Position as a Client

One of the most underappreciated aspects of these decisions in prior discussions of them is the difference in the parties’ litigation postures—and how that difference drove the work product analysis.

Warner’s plaintiff was pro se. She was acting as her own counsel. This means that when she used ChatGPT to prepare litigation materials, she was doing what a lawyer does by using a tool to develop strategy and prepare documents in anticipation of litigation. Her materials were prepared by the functional equivalent of an attorney—because she was acting as her own attorney.

Heppner’s defendant, by contrast, had retained counsel—but counsel did not direct him to use Claude. He acted on his own, and then when the documents were seized, he tried to protect his AI searches by flinging out a desperate assertion of work product privilege. The court held that his AI-generated documents were not “prepared at the behest of counsel” and did not “reflect defense counsel’s strategy.” Without that connection to counsel, the work product doctrine’s purpose—protecting “a zone of privacy in which a lawyer can prepare and develop legal theories and strategy”—was not applicable.

Judge Rakoff also addressed—and rejected—the broader argument that work product protection extends to materials not prepared by or at the direction of an attorney. Heppner’s defense had cited Shih v. Petal Card, Inc., 565 F. Supp. 3d 557 (S.D.N.Y. 2021), a separate decision in which a magistrate judge held that work product protected a plaintiff’s litigation materials “regardless of whether” her lawyer “directed the work.” Rakoff “respectfully disagree[d]” with Shih, citing extensive Second Circuit authority for the proposition that the doctrine exists to protect lawyers’ mental processes and applies to material “prepared by or for counsel.” That reasoning creates an implied tension with Warner’s “tools, not persons” approach—but Rakoff did not cite or address Warner, which was decided the same day.

But here is the critical nuance—the tension between these courts is narrower than it first appears. Warner’s pro se plaintiff was acting as her own counsel—so her materials would likely satisfy even Heppner’s stricter “at the behest of counsel” standard. The real disagreement surfaces only when a non-lawyer uses AI independently, without functioning as or acting at the direction of counsel. That was Heppner’s situation. It is not and will not be the situation of most lawyers reading this article.

The lesson for firms is that the distinction between attorney-directed AI use and independent client AI use is legally significant. If your client is using AI on their own—without your direction or involvement—that creates a different and weaker privilege and work product posture. Advise clients accordingly and document your own direction over AI-assisted work.

4. The Vendor’s Privacy Policy Is Now Part of the Evidence

The single most actionable detail from Heppner is Judge Rakoff’s treatment of Anthropic’s privacy policy as direct evidence that the defendant had no reasonable expectation of confidentiality.

The court examined the policy in detail. It noted that Anthropic’s privacy policy regarding the tool Heppner was using (public / free tier, with no privacy settings on) permits the company to collect user inputs and outputs, use that data for model training, and disclose information to third parties. The court further cited Footnote 3, observing that “even if certain information that Heppner input into Claude was privileged, he waived the privilege by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party.”

The vendor’s terms of service were the factual foundation of the court’s confidentiality analysis. If Heppner had used an enterprise platform with a Data Processing Agreement that contractually prohibited training on his data, restricted vendor employee access, and imposed confidentiality obligations--or even just toggled on the privacy settings (to not 'Improve the Model for Everyone') the court's analysis would have started from a fundamentally different factual premise.

The implication is that practitioners need to read AI vendor privacy policies and terms of service with the same rigor they apply to Data Processing Agreements—because courts may look to and cite those policies as evidence of what confidentiality expectations were reasonable. A UI toggle that says 'don't train on my data' may or may not hold up in court but it arguably shows a reasonable expectation of privacy. Especially for those who understand how LLMs work. Of course a contractual commitment in a DPA is stronger.

Be sure you can answer these questions: What does this vendor’s privacy policy permit? Does it allow training on my inputs? Does it permit human review? Can the vendor disclose my data to third parties? Is there a DPA—and if so, what does it actually say? These are the facts a court will examine if your AI use is ever challenged and evidence that you are using reasonable safeguards.

5. Document Attorney Direction—The Through-Line Both Courts Agree On

Despite their different reasoning, both courts point to the same practical imperative. The lawyer’s involvement in and direction of the AI interaction is a critical variable, if not the critical variable.

Heppner denied protection in part because counsel “did not direct [Heppner] to run Claude searches.” The Court left open that counsel-directed use could yield a different result. Warner protected work product created by a pro se plaintiff who was functioning as her own counsel—satisfying the attorney-direction element by definition. Read together, the consistent message is when an attorney directs the AI interaction on a platform with privacy options on, the information is protected.

First, document this by establishing prompt conventions and matter codes that connect AI interactions to specific client matters and demonstrate that the work was performed at counsel’s direction, in anticipation of litigation or for legal analysis. Second, implement supervision protocols under Rule 5.1 and Rule 5.3 so that when staff or interns use AI tools, the supervising attorney’s direction is documented. Third, create a written AI use policy that establishes, as a matter of firm practice, that AI-assisted work is attorney-directed work product—prepared in anticipation of litigation or for legal analysis, under counsel’s supervision and control.

You likely already document attorney direction when you assign research to associates, engage expert consultants, or direct paralegals to prepare litigation files. Treat AI tools the same way.

Looking Ahead

Heppner and Warner are district court opinions—persuasive authority at best, binding on no one outside their respective districts. More decisions are coming and appellate courts will of course weigh in. Also look for state bars to issue additional guidance and counsel opinions.. The legal landscape around AI privilege and work product is going to develop quickly.

But here's the most important part of this, at least to me -- the core principles these courts articulated are not new principles. Privilege has always required a reasonable expectation of confidentiality. Work product has always required preparation in anticipation of litigation. Waiver has always turned on the nature of the disclosure—who you disclosed to, and under what circumstances. Heppner and Warner applied those established principles to a new technology. Future courts will do the same.

Until the case law shakes out on these issues, make certain that you have the facts on your side—the right platform, the right contractual protections, a written AI policy, an AI use and privacy statement in your engagement letter, and a documented record of attorney direction, because these factors will become your protection if your AI use is questioned.

Case References

United States v. Heppner, No. 1:25-cr-00503-JSR, Doc. 27 (S.D.N.Y. bench ruling Feb. 10, 2026; written opinion Feb. 17, 2026) (Rakoff, J.). Criminal securities and wire fraud prosecution. Defendant generated approximately 31 documents using Claude, a consumer AI chatbot operated by Anthropic. Court denied privilege and work product claims. One of the first known federal decisions addressing AI-generated documents and attorney-client privilege.

Warner v. Gilbarco Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026) (Patti, M.J.). Employment discrimination action. Pro se plaintiff used ChatGPT to prepare litigation materials. Court denied defendant’s motion to compel AI interactions, holding that work product protection was not waived because AI tools are “tools, not persons” and disclosure to an AI vendor is not adversary disclosure.

Best Practices For Lawyers and Legal Professionals:

1. Use a Safe AI Platform. Most secure is an enterprise AI platform with a signed DPA. At least toggle every privacy control “On.” Consumer-tier tools with no privacy settings engaged are a near-guaranteed denial of privilege.

2. Read your vendor’s privacy policy and terms of service. Know what the vendor can collect, train on, and disclose. Make sure you’re ok with this.

3. Document Attorney Direction Over Every AI Interaction, Especially For LA’s and Paralegals. Both courts treated the lawyer’s involvement as a critical variable. Using matter codes and prompt conventions can easily create a paper trail.

4. Adopt a Written Firm AI Use Policy. Establish as a matter of firm practice that AI-assisted work is attorney-directed work product, prepared under counsel’s supervision.

5. Advise clients about independent AI use. If a client uses AI without attorney direction, that creates a weaker privilege and work product posture. Counsel them so they don’t waive privilege before they understand it.

6. Lean on work product doctrine, not just privilege. Warner held that disclosure to an AI vendor is not adversary disclosure. Work product may be the more durable shield.

This article is part of a series on AI and attorney-client confidentiality. See also: Is It Safe to Put Confidential Information in AI Tools? and 9 Privacy Myths About Attorney-Client Confidentiality with AI Tools.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

The question I get asked more than any other by attorneys—at every conference, in every CLE, over a casual lunch and even in the restroom—is this: “Is it safe to put privileged or confidential information into AI tools?” Not surprisingly the answer is that it depends—on which tool, how it’s configured, what your engagement agreement says, and the vendor’s terms of service and privacy policy.

AI adoption in legal practice is accelerating because it delivers real productivity gains—drafting, research, document review, and analysis that used to take hours can now take minutes. The duty of competence under Model Rule 1.1 increasingly requires familiarity with and use of AI tools. But the duty of confidentiality under Rule 1.6 requires that you understand where your client’s data goes before you transport it into cyberspace.

Here is my considered, researched position:

Putting confidential client information into properly configured AI tools is no less safe than using the cloud-based practice management, document management, and email systems lawyers already rely on every day.

Yes, you can put confidential information into AI tools—provided you select the right tier, enable the right privacy controls, and apply the same vendor scrutiny you already use for other cloud platforms. If lawyers understood AI tools, their data usage, and cloud platforms, they would likely calm down about using AI tools and putting confidential information into those AI tools. And that’s my goal for this article.

First, the Risks

We can all agree attorney-client privilege is and always will be sacrosanct. It is our highest duty to our clients; central to our effective representation of the client. And it’s the client’s privilege to waive, not ours so we treat it with extra care. Before evaluating any specific tool, lawyers need to understand there are certain risks that won’t go away. But—and this is the point this article will keep returning to—risks exist in every piece of cloud-hosted software your firm already uses.

Risk 1 -- Architecture Problem

There is one bright-line rule regarding AI use that I can give without qualification: Never submit anything of consequence—client data, privileged communications, confidential business information—into a free-tier AI tool. Ever.

Free tiers are advertising products. They are monetized through data collection, model training, and usage analytics. If you are not paying for the product, your data is the product, even if you are choosing not to “help improve the model for everyone.” That’s not to say that the information you enter even into a free tier AI tool will be easily retrievable, for the reasons set out below. But using free tools doesn’t show the reasonable care required by our professional duties. Every substantive discussion about AI and confidentiality starts above the free tier.

Risk 2 – Subpoenas and Government Access

Any data stored on vendor servers is potentially reachable by subpoena. This is true of every AI tool on the market, including legal-specific platforms like Harvey. But notably it is also true of data stored in the cloud, on your DMS, email, and PMS platforms.

Third-party subpoenas to AI vendors are uncommon today, but the legal infrastructure to compel production exists. Metadata and prompt logs could become discoverable artifacts in litigation. The Stored Communications Act (18 U.S.C. §§ 2701–2713 as part of the Electronic Communications Privacy Act of 1986) provides some protection, but it was not written with AI prompt logs in mind, and its application here is unsettled.

Courts have addressed these issues in the context of legal hold obligations, and the same frameworks will likely apply to AI vendors.

Risk 3 -- Third-Party Access

Human employees at AI companies—trust and safety teams, model trainers, quality evaluators—may review your prompts. They have no professional obligation of confidentiality, no bar license, and no malpractice exposure. But again, the same is true of the support engineers, system administrators, and compliance teams at your DMS provider, your email host, and your practice management vendor. Do you really think Microsoft can’t access every single one of your documents stored in the MS cloud environment if it wanted to? The relevant inquiry is whether AI vendor access is contractually bounded and limited to defined purposes—the same inquiry you should be making about every cloud platform in your stack.

Risk 4 – User Error

This is perhaps the most pernicious risk, but is more easily contained. The humans using AI are the biggest threat to confidentiality. Shadow use of unapproved tools, no data governance plan, no AI policy, and no training all can lead to leakage of your confidential data. Rather than belabor those risks, I refer you to the linked articles.

There are risks, as with any cloud platform, but they can be managed.

LLMs Are More Privacy Friendly Than You Think

LLMs are more privacy friendly that you are currently imagining. There were several incidents when AI tools became popular, and they have resulted in “leak lore” that some still let impact their views of AI tools. But to accurately assess the risks of using AI tools for legal work, you need to understand more about how large language models actually work.

LLMs are Stateless

Retrieving information stored in an LLM is not like retrieving information from a database. LLMs are stateless which means that prompts, attachments and information you submit to an AI tool are not stored verbatim in some huge database somewhere that keeps growing every minute, every second. Each conversation begins from scratch. The model has no memory of prior sessions, no index of previous prompts, and no mechanism to retrieve what you or anyone else typed yesterday. When a session ends, your input exist only in the vendor’s server logs (subject to the retention policy and DPA) and wherever you saved it—not in the model’s active memory. An LLM is an inference engine; it generates responses based on patterns learned during training, not by looking up stored inputs. This is fundamentally different from a database, which stores and retrieves records.

Your Data Is Just Not That Important

Consider the worst case-- free tier, training enabled. You are sharing all of your data with the LLM for training and use. Even then the risk of a model reproducing your specific prompt is vanishingly small. AI tools do not “store” individual inputs. Each tool adjusts statistical weights across billions of parameters using aggregated data. The process is closer to adjusting the balance on an equalizer than to saving a file. A single prompt has negligible influence on a model trained on trillions of tokens or words. Modern training techniques—such as deduplication and differential privacy—are specifically designed to prevent verbatim memorization of training data. The AI memorization is an edge case, not a systemic exposure. Think of it this way. Consider one tiny drop of oil in an ocean. Once that drop hits the ocean, it starts to disperse. It’s impossible to recapture that one drop of oil, and only the oil. Now imagine a bucket of oil dumped into the ocean. Yes, you’ll see it more readily and can monitor and recapture at least part of it but there will be dispersal and dissemination. Finally, imagine the Exxon Valdez—a large oil tanker—spilling millions of gallons of oil in the ocean near Alaska. You couldn’t help but see and be affected by the oil if you were in the area, because there was a higher oil-to-water ratio. Fish died of asphyxiation and wildlife had to be cleaned off by hand using detergent.

Now imagine that your client’s most confidential information is entered into an AI tool. It’s like that drop of oil. Sure, it’s in the ocean, but it has dispersed. You aren’t going to get it back very easily, and not intact. With a bucket of data, there’s a slightly higher chance you’ll see something that resembles your data, but is still statistically unlikely. Once the data you feed in amounts to millions of gallons, you can’t help but encounter some of the data being spewed back out at you. My point is this – unless you and a bunch of others put a whole lot of data, about something so novel, so interesting, so shocking, or so important, you (and your opposing counsel) are not going to be able to get it back out of the AI tool intact. And that’s what I mean by “your data is likely just not that important.”

None of this means lawyers should be cavalier. The vendor’s server logs still exist, and are still reachable by subpoena, and retention periods still matter. But the technical architecture of LLMs provides a layer of structural protection that has no analogue in traditional document storage. Your DMS stores your documents and can return them verbatim to anyone with access. An LLM—even one that trained on your data—almost certainly cannot.

The Cloud Comparison Lawyers Are Ignoring

Consider what lawyers are already doing without a second thought. Clio, NetDocuments, iManage, Microsoft 365, Google Workspace—all live in the cloud and process and store confidential client data on third-party servers. Lawyers signed up for these platforms, clicked through their terms of service, and moved on.

The ABA has acknowledged that storing privileged communications with a cloud service provider does not waive privilege where the lawyer took reasonable precautions. ABA Formal Opinion 477R (2017) confirmed that confidentiality obligations apply to electronic communications and that reasonable precautions include vetting service providers. The opinion lays out a multi-factor reasonable efforts standard—assessing the sensitivity of the information, likelihood of disclosure without additional safeguards, cost of safeguards, difficulty of implementation, and the client’s own instructions. AI tools are the next iteration of the same analysis. If encrypted cloud storage of intact, retrievable documents does not waive privilege, a properly configured AI tool with equivalent or stronger protections of dispersed data should not either.

ABA Formal Opinion 512 (2024) provides the current ethical framework. It requires that lawyers understand the terms of any AI tool before using it, obtain informed client consent before inputting confidential information into tools that may use data for training, and exercise supervisory obligations under Rules 5.1 and 5.3 when staff use AI tools. Boilerplate consent language in engagement letters will not satisfy the informed consent standard; I’ve included a paragraph you can use and modify for your needs

.

Does Using AI Waive Privilege?

The developing case law on AI and attorney-client privilege is sparse but instructive. Two district court decisions issued on the same day give us guidance. I’ve only highlighted them here; I analyze and explain them in depth in a companion article.

US v Heppner and Warner v Gilbarco

Two cases from district courts—persuasive authority at best—can nonetheless give us insight into how courts might consider these issues. In United States v. Heppner a criminal defendant generated documents using Claude. The judge found they were not protected by attorney-client privilege or the work product doctrine, because he was not obtaining them at the direction of his legal counsel. Further, he had no reasonable expectation of confidentiality because the version he was using permitted data collection, model training, and disclosure to third parties.

On the same day, the court in Warner v. Gilbarco Inc. reached a compatible result on different facts. A pro se plaintiff used ChatGPT as part of her case preparation. The defendant moved to compel production of her AI interactions, arguing that using the AI tool waived any protection. The judge disagreed, because ChatGPT is a tool and work product can only be waived by disclosure to an adversary.

Sharing work product with an AI tool is not adversary disclosure—but you still need to show counsel’s involvement. Both decisions left open that counsel-directed AI use on a secure platform could yield a different result.

Type of Privilege Matters

One distinction worth understanding is that attorney-client privilege and the work product doctrine are separate protections with different waiver standards. Privilege protects confidential communications between attorney and client; it can be waived by voluntary disclosure to any third party.

Work product protects materials prepared in anticipation of litigation. Waiver of it requires disclosure to an adversary or someone likely to disclose to an adversary. Warner relied on exactly this reasoning—AI tools are “tools, not persons,” and sharing materials with a tool is not disclosure to an adversary—meaning work product protection survived the pro se plaintiff’s use of ChatGPT. The Warner plaintiff was acting as her own counsel, so her materials satisfied even the stricter standard that Heppner articulated; that of preparation at counsel’s behest. The bottom line is that work product is the stronger doctrinal argument for protecting AI-assisted legal work, and an attorney who directs the AI interaction is well-positioned under either court’s reasoning.

What to Do Monday Morning

Update your engagement letters and your AI policy. These are evidence of your reasonable precautions. And then answer these questions about your AI tools:

1. Does the vendor use my input data to train its models? Can I reliably, verifiably turn that off?

2. Can vendor employees access my prompts? For what purpose? Is AI tool access different than any other cloud platform?

3. What is the data retention period? can I minimize it, and/or request deletion? If not, am I comfortable with it?

4. Does the vendor offer a DPA at my subscription tier?

5. Are my AI interactions attorney-directed work product?

These are exactly the questions you should already be asking about your DMS, your PMS, and your email provider. If you vetted Clio, NetDocuments, or iManage before onboarding—and you should have—then you already know how to do this. Apply the same standard. The only thing that has changed is the category of tool.

Conclusion

I’m still a lawyer. And I will never guarantee an AI tool to be unequivocally “safe.” “Safe” is a risk management decision—the same kind of decision lawyers make every time they transmit client information electronically—through whatever means. No cloud platform is perfectly secure, just like no physical location is perfectly secure. Law firms are hot targets for bad actors specifically because they maintain confidential and valuable information, and aren’t always hardened against cybersecurity attacks. And so, you need to make that decision of “safe” vs. “not safe” yourself, based on your firm’s preparedness. But make it based on actual verification and understanding, not fear and speculation.

What I hope you have taken away from this article is that with the appropriate precautions, AI tools are safe for confidential information. Privacy controls exist. Contractual protections exist. Use them. At the paid and enterprise tiers, the major AI platforms offer encryption, training opt-outs, SOC 2 Type II and ISO 27001 certification, and DPAs that are functionally equivalent to—and in some cases stronger than—what lawyers accepted years ago from their cloud DMS, PMS, and email providers. If you are comfortable sending whole, intact client documents through Microsoft 365 and storing case files in NetDocuments, then a properly configured AI tool presents an equivalent risk profile.

Best Practices for Lawyers Using AI Technology

1. Maintain technological competence. Stay current on the capabilities, limitations, and risks of AI tools you use. (Model Rule 1.1, Comment 8; ABA Formal Op. 512 §II.A; ABA Formal Op. 477R §II)

2. Independently verify all AI output. You are fully responsible for the work you sign. Never file, send, or rely on AI-generated work product—including legal citations, case analysis, and factual assertions—without reviewing it for accuracy. (Rule 11, Op. 512 §II.A)

3. Match security measures to sensitivity. Apply a risk-based, fact-specific approach: assess the sensitivity of the information, the likelihood of disclosure, the cost and difficulty of safeguards, and the impact on your ability to represent the client. (Op. 477R §III, Comment [18] factors)

4. Communicate with clients about AI use. Use your engagement letter to disclose your use of AI tools. (Op. 512 §II.C) You are welcome to lift the example included below.

5. Establish firm-wide AI policies and training. Create clear policies on permissible AI use and train all lawyers and staff on ethical obligations, data handling, and the specific tools in use. (Op. 512 §II.E; Op. 477R §III, item 6)

6. Conduct due diligence on AI vendors. Vet providers for security protocols, data-retention practices, confidentiality commitments, breach-notification procedures, and enforceability of contractual protections—just as you would any outsourced service. (Op. 512 §II.E; Op. 477R §III, item 7)

7. Comply with court-specific AI disclosure rules. Check local rules and standing orders for any requirement to disclose AI use in filings. Regardless, ensure all submissions satisfy Rules 3.1, 3.3, and 8.4(c)—no fabricated citations, no false statements, no misleading arguments. (Op. 512 §II.D)

8. Label privileged and confidential communications. As an extra precaution include “privileged and confidential” in your prompts to trigger duties under Model Rule 4.4(b). (Op. 477R §III, item 5) And if you are directing another to use an AI tool for you, document AI use as attorney-directed work product. (Rules 5.1, 5.3; Op. 512 §II.E)

Still have questions? Check out the follow-up to this article, 9 Myths About AI Privacy for Lawyers.

__________________________________________________

The Vendor Comparison Of What You Actually Get

The following table compares five widely used AI tools—four general-purpose platforms and one legal-specific platform—across the privacy dimensions that should matter to lawyers. Source: OpenAI Enterprise Privacy, Anthropic Privacy Center, Google Workspace AI Privacy, Microsoft 365 Copilot Privacy, Harvey Security.

Note: double check this information, especially the data retention timeframes, as policies and features frequently change.

At the enterprise tier, all five vendors—general-purpose and legal-specific alike—offer contractual commitments against training on your data, DPA coverage, SOC 2 Type II and ISO 27001 certification, and industry-standard encryption. At the paid individual tier, protections exist but are thinner—privacy toggles rather than contractual commitments, and human review for safety purposes remains possible across the board. No tier fully eliminates all vendor access, which, again, is exactly the same as your DMS, your email provider, and your practice management platform. And every AI tool, regardless of vendor or tier, stores data on servers reachable by third-party subpoena.

Is Harvey Better?

Harvey deserves specific comment here. Some lawyers treat legal-specific AI tools as inherently safer than general-purpose tools like ChatGPT or Claude. I heard an AI ‘expert’ tell fellow lawyers that Harvey is safe to use for confidential information but the other general-purpose tools are not. That statement was based on, as far as I can tell, exactly nothing. The chart shows why that statement is false. Harvey’s security posture (SOC 2 Type II, ISO 27001, AES-256, no training by default) is strong, but it mirrors what Claude, ChatGPT, Gemini, and Copilot offer at enterprise tier—every one of which holds SOC 2 Type II and ISO 27001 certification. The protections flow from the vendor’s security architecture and contractual commitments, not from whether the tool was built for lawyers. A legal-specific label does not substitute for reading the DPA. And it bears remembering that every legal-specific AI tool is built on top of one or more frontier AI models (eg Claude, ChatGPT, or an open-source tool). Currently there is no AI tool purpose-built only for legal use.

__________________________________________________

SIDEBAR: Model Engagement Letter Language for AI Tool Use

The following paragraph may be adapted for inclusion in engagement letters or supplemental client disclosures. Bracketed items should be customized to your firm and tools.

In the course of representing you, our firm may use artificial intelligence tools, including without limitation, [tool name(s)], to assist with [drafting, research, document review, analysis]. These tools are provided by third-party vendors and process information on cloud-based servers. We use [paid/enterprise]-tier subscriptions with the following privacy controls enabled: [training data opt-out is enabled; data is not used to improve the vendor’s models; a Data Processing Agreement governs the vendor’s handling of information]. While these tools employ industry-standard encryption and access controls, vendor employees may have limited access to submitted information for safety and abuse-detection purposes, consistent with how cloud-based document management and email systems operate. AI-assisted work product is prepared at the direction and under the supervision of the attorneys assigned to your matter. We do not submit [categories of excluded information, e.g., Social Security numbers, financial account numbers] to AI tools under any circumstances. By signing this engagement letter, you consent to our use of these tools under the conditions described above. If you have questions or wish to restrict or prohibit our use of AI tools in your matter, please let us know.

Note: This language is designed to satisfy the informed consent standard articulated in ABA Formal Opinion 512. It identifies the tool, describes the privacy posture, discloses the residual risk (vendor safety review), establishes attorney direction over AI work product, and gives the client the opportunity to opt out. Firms should update this language as vendor terms, case law, and ethical guidance evolve.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

On the night of March 8, 1928, Captain Walton of the tugboat Montrose steered his tow of three coal-laden barges out of Hampton Roads, Virginia, bound for New England. Somewhere below deck sat a radio receiver—homemade, unreliable, and by his own later admission, largely useless. Other tug captains working the same coastline that night—the masters of the Mars, the Waltham, the Menominee—had functioning sets. They picked up weather bureau broadcasts warning of a gale building off the Jersey coast. They turned their tows toward the Delaware Breakwater and rode out the storm in shelter.

Captain Walton did not receive the warning. Neither did the master of the T.J. Hooper, a sister tug running the same route with no working radio at all. By noon on March 9, the barometer dropped, the wind was blowing an easterly gale, and the sea was punishing. By nightfall, two barges were lost. Not surprisingly, the cargo owners sued.

The tug owners had a reasonable defense. They couldn’t have known about the storm without a radio. And almost no tugboat company required radios. The industry hadn’t adopted them as standard equipment. Custom, customary usage, industry standards—they were all on the tug owners’ side.

Judge Learned Hand of the Second Circuit was unpersuaded. In The T.J. Hooper, 60 F.2d 737 (2d Cir. 1932), he delivered what remains one of the most consequential sentences in American tort law: “[A] whole calling may have unduly lagged in the adoption of new and available devices. It never may set its own tests, however persuasive be its usages. Courts must in the end say what is required.” Id. The cost of a radio was trivial. The risk of not having one was catastrophic. Industry custom was no shield.

Nearly a century later, the legal profession is now essentially in Captain Walton’s wheelhouse—navigating increasingly complex waters with a transformative tool within easy reach, while a not-negligible portion of the profession has yet to turn it on, and even less use it profitably, effectively, and safely.

What The Evidence Shows

The empirical case for AI in legal practice has moved beyond anecdote. In 2025, Professor Daniel Schwarcz at the University of Minnesota Law School published the results of a rigorous randomized controlled trial measuring AI’s impact on realistic legal tasks. Upper-level law students were assigned six practice-like assignments—contract analysis, memo drafting, regulatory research—using either AI tools or none. The results were striking. AI-equipped participants saw productivity gains of 34–140%, with statistically significant quality improvements of 10–28% across four of six tasks. Time-on-task dropped 12–37%. The researchers called this “a significant departure from earlier studies, which generally reported limited quality gains.”

This is not an isolated finding. Thomson Reuters reported that AI saved lawyers an average of four hours per week in 2024, projecting twelve hours weekly within five years. The Vals Legal AI Report found AI outperforming human lawyers in four of seven legal performance areas tested. Harvard Law School’s Center on the Legal Profession documented a complaint-response system that reduced associate time from sixteen hours to three to four minutes. Lawyers surveyed by Everlaw reported saving up to 32.5 working days per year with generative AI. I have lawyers complain to me that adopting AI creates more work, because they have to read the original material, plus read the AI output. This is a fundamental misunderstanding of the technology and how to use it. Find the use cases that are ideal for your needs.

Adoption is increasing. The 2024 ABA Legal Technology Survey found that 30% of lawyers now use AI, up from 11% in 2023. Litify’s 2025 survey puts the figure at 78% of legal professionals, with two-thirds using AI daily or monthly. The holdouts are shrinking. Only 4% of Litify’s respondents—what Litify unsympathetically calls the ‘Laggards’-- said they would never implement AI, down from 9% in 2023.

The Doctrinal Malpractice Framework Already Exists

The T.J. Hooper is not the only precedent requiring lawyers to up their technology game. In Helling v. Carey, 519 P.2d 981 (WA 1974), the Washington Supreme Court held that an ophthalmologist was negligent as a matter of law for failing to administer a simple, inexpensive glaucoma test to a young patient—even though the prevailing medical standard did not require it for patients under forty. The test was cheap, harmless, and could have prevented devastating vision loss. The court cited Justice Holmes: “[W]hat usually is done may be evidence of what ought to be done, but what ought to be done is fixed by a standard of reasonable prudence, whether it usually is complied with or not.” Texas & Pac. Ry. Co. v. Behymer, 189 U.S. 468, 470 (1903).

Justice Holmes’ quote tracks with AI adoption today. AI tools are relatively inexpensive. Many legal-specific platforms cost less than a single billable hour per month. General purpose tools like Gemini, ChatGPT and Claude [AS1] cost only around $10-20 per month. They are demonstrably effective. They improve both speed and quality. Under the logic of T.J. Hooper and Helling, a court need not wait for universal or even majority adoption to find that reasonable care and competence require their use.

The ethical infrastructure reinforces this. In 2012, the ABA amended Comment 8 to Model Rule 1.1 to require that lawyers “keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.” Forty-two states have now adopted this language. In July 2024, ABA Formal Opinion 512—the first formal ethics guidance on generative AI—went further, specifying that lawyers must have “a reasonable understanding of the capabilities and limitations” of AI tools, that fees must remain “reasonable” in light of AI’s efficiency, and that uncritical reliance on AI output without verification violates the duty of competence.

Read together, the doctrine and the ethics rules describe a closing circle. The standard of care is what a reasonably competent attorney would do. A reasonably competent attorney keeps abreast of relevant technology. A reasonably competent attorney uses the tools that will make their practice more effective. It follows then, that a reasonably competent attorney should adopt technology that is available, affordable, and will bring a benefit to their practice. That competence increasingly requires AI use.

The Fee Problem Nobody Wants to Talk About

The legal practice’s disincentive that’s no longer a secret is that there is another dimension to this argument. And it cuts closer to the bone. If a document review task takes sixteen hours manually but four minutes with AI, billing the client for sixteen hours of manual labor, or even ten hours raises serious questions under Model Rule 1.5 (Fees). ABA Opinion 512 explicitly ties fee reasonableness to AI capabilities. Yet the data suggests the profession is slow to reckon with this. According to Axiom Law, 79% of firms use AI to boost efficiency, but only 6% pass those savings to clients. In a revenue-first move, 34% actually charge premium rates for AI-enhanced work. Only 7% of clients reported noticing any reduction in total matter costs.

It stands to reason that attorneys, who rate themselves, their bonuses, and their very value on their time bills, do not want to lose revenue or the pride in monumental amounts of time billed. This competitive suffering is not likely to end soon, even with the out that AI adoption might offer. Attorneys don’t just endure billable hour constraints, they rank themselves by it. However surprising to outsiders, this ‘misery as professional status’ is not likely to change soon, and so clients are not seeing AI’s efficiency benefits in their monthly statements.

But this disconnect is not sustainable. In-house departments are taking notice. A LexisNexis study found that in-house teams deploying AI at scale could reduce work sent to outside firms by 13%. Twenty-six percent of in-house counsel expect to cut law firm spending in 2026. It’s not surprising that in house counsel are among the highest adopters of AI. And corporate clients are increasingly pushing firms to adopt generative AI specifically for cost savings—and when the client is the one demanding efficiency, a lawyer’s refusal to adopt available tools starts to look less like professional judgment and more like dragging your feet to keep fees high.

There is also an access-to-justice dimension that the profession cannot afford to ignore. The American Bar Association has long acknowledged that the majority of low- and moderate-income Americans lack meaningful access to legal representation. If AI can reduce the cost of competent legal work by an order of magnitude—and the evidence increasingly suggests it can—then we as a profession should be looking for ways to help disadvantaged communities. This is a justice problem.

AI is also a level-set. The same tools that make BigLaw associates faster can make solo practitioners in underserved communities more viable. Or even create a more level playing field and competitiveness in solo practitioners and small firms.

Yes, But What About Hallucinations?

The strongest objection to treating AI use as a standard-of-care requirement is the hallucination problem, and it is a real one. Around 1,000 documented cases of AI-generated legal hallucinations are now on record, implicating more than 128 lawyers—including attorneys at top-tier firms. In Mata v. Avianca (S.D.N.Y. 2023), attorneys submitted a brief containing six entirely fabricated case citations generated by ChatGPT and were sanctioned $5,000. Since then, fines are increasing for AI-hallucinated filings, and the pace of sanctions cases is accelerating. Even judges are not immune.

But this objection, properly understood, is actually an argument for competent AI use, not for non-use. The lawyers in Mata were not sanctioned for using AI. They were sanctioned for failing to verify AI output—a violation of the most basic duty of candor to the tribunal. The standard of care must require AI use with appropriate verification, in the same way that lawyers have always been required to verify research from any source. A lawyer who cites a case without reading it is negligent whether the citation came from ChatGPT, a new associate, a colleague’s memo, or a footnote in a treatise.

Other objections fare no better under scrutiny. The “too early” argument—that adoption is too uneven for AI to constitute a professional standard—is precisely the defense that Judge Learned Hand (yes, I love his name) in T.J. Hooper rejected. The digital-divide concern—that small firms lack resources—is diminished by the reality that many effective AI tools cost $10–100 per month, less than the profession’s historical adoption of computerized legal research. The de-skilling argument echoes objections made about calculators, Westlaw, and spell-check. The profession adapted. It will again. It will have to in order to stay viable.

What Comes Next

We have not yet seen a successful legal malpractice claim premised solely on a lawyer’s failure to use AI. But the architecture for one is in place. The elements are straightforward: a lawyer fails to use an available AI tool; the work product is slower, more expensive, or lower quality than what AI-assisted counsel would have produced; the client suffers actual harm as a result. The “case-within-a-case” requirement—the plaintiff must prove that AI use would have had a substantial impact on the outcome—remains a meaningful hurdle. But in cases involving missed research, overlooked precedent, or excessive fees, that hurdle is increasingly surmountable.

Watch for malpractice insurers to move first. If carriers begin factoring AI adoption into underwriting—offering discounts, rather than higher premiums for firms with AI policies or surcharges for those without—the standard of care is shifting, even before any court rules. Watch also for court-imposed AI disclosure requirements, which are already emerging in several jurisdictions. I strongly maintain that these disclosure requirements are unnecessary, and that Rule 11 is sufficient. But they are a signal to pay attention to. And watch for the cases themselves. The most likely early claims will not involve exotic AI failures; they will involve lawyers who spent forty hours on research that AI could have completed in two, billed accordingly, and missed a dispositive case that the AI would have found. While it may not be economically feasible to bring a malpractice case over 38 hours overbilled, imagine that scenario at scale, where the savings would be in the hundreds of thousands. Even 100 hours billed at $500/hour for a cost difference if $50,000 is not merely a rounding error.

Competent AI Use

What does competent AI use look like in practice? First and foremost, it means reading all of your output. All. Verifying every citation and quote. It means understanding what the tools can and cannot do, and how to use them best. It means exercising independent professional judgment at every stage. It means having a firm-level AI policy that addresses confidentiality, data security, client communication, and supervision. In short, it means treating AI the way a competent lawyer treats any powerful tool: with informed skill, appropriate caution, and unwavering professional responsibility. At least ideally.

The deeper point is not that every lawyer must become an AI expert. ABA Opinion 512 is explicit on this. It is that willful ignorance of a tool that demonstrably improves both the quality and affordability of legal services is becoming harder to reconcile with the duties of competence, diligence, and loyalty that define the profession. No lawyer is expected to become a machine-learning engineer to stay competent in their legal practice. Just know enough to choose the right tool for the task, how to prompt effectively, and use context engineering to your advantage, and to evaluate the output critically.

The Bottom Line

The radio was available, and inexpensive. The captains who turned it on and took advantage of its benefits survived the storm, cargos intact. The ones who didn’t, lost their cargo—and lost the case. I imagine Captain Walton felt angry and foolish, in retrospect. How easy it would have been to buy a radio, instead of trying to make-do with his homemade version. In the moment he probably felt like it took too much time to procure one, or figured he’d get around to it when he wasn’t so busy. (Sound familiar?)

After retaining an attorney, explaining his failure to the court, and then losing his case in court, how easy it must have seemed by comparison to get a radio. Keep it handy. Turn it on. What stopped him from doing so? He likely didn’t think it was the standard of care at the time. In fact he treated the radio somewhat as a toy. This was probably a lack of understanding of the bigger picture. He did not fully appreciate what a radio could do for him, and that, combined with the very real ‘human inertia’ we all deal with on a daily basis, made a huge negative impact in his professional life.

We’re facing a very similar situation as Captain Walton faced in March 1928. The technology is available, affordable, and effective. Don’t wait until the storm is upon us, threatening to sink your tugboat before getting your radio and learning how to use it effectively and safely.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Of all professionals, lawyers should be the least surprised when delegation creates liability. We spend careers analyzing principal-agent relationships, parsing scope of authority, and litigating whether someone acted within their delegated powers. We know that when you appoint an agent, you’re responsible for what they do within the authority you’ve given them.

Yet somehow, when the agent is artificial rather than human, we forget centuries of jurisprudence and treat it as a productivity tool instead of a legal actor. This is not a metaphor. When you deploy an autonomous AI system with authority to access documents, draft communications, and make decisions on your behalf, you’ve created an agent in the legal sense. The fact that it runs on silicon rather than neurons doesn’t change the analysis.

Consider what happened to Clawdbot in early 2025.

The Clawdbot Disaster (Agency + Autonomy = Chaos)

Clawdbot promised to be the personal AI assistant everyone wanted. Autonomous, capable, always-on. It connected to WhatsApp, Telegram, Slack, Signal, iMessage, email, and calendars. It could execute shell commands and maintain persistent memory across your entire digital life. It was genuinely agentic, designed to act independently toward objectives you set.

Within 72 hours of going viral, security researchers documented what they generously termed a “dumpster fire.” Over 1,000 exposed servers. Prompt injection attacks that exfiltrated credentials in minutes. Plaintext storage of API keys and OAuth tokens (a huge security no-no). A proof-of-concept supply chain attack through the community skills repository.

The CEO of Archestra AI demonstrated the most elegant attack. He sent a crafted email to an inbox Clawdbot was monitoring. When the agent processed the message, injected instructions caused it to search the filesystem and exfiltrate a private SSH key. No direct system access required, just content the agent would read and dutifully execute.

This wasn’t a mistake per se. The agent was doing exactly what it was authorized to do. It read email. It accessed files. It executed commands. It followed instructions. Every action was formally within scope. The problem was that the model simply couldn’t distinguish “process this email” from “rummage through ~/.ssh and exfiltrate keys.”

In agency law terms, the agent acted within its apparent authority. The principal is liable. That the principal didn’t intend the specific action is irrelevant. That’s how agency works.

Lawyers Should Know Better

Every first-year law student learns the basic framework. When you appoint an agent, you’re liable for their acts within the scope of authority you’ve granted. Actual authority, apparent authority, ratification after the fact—the details vary but the principle doesn’t. The agent’s conduct becomes your conduct for legal purposes.

This applies whether your agent is a summer associate, a registered agent for service of process, or an AI system you’ve authorized to access client files and draft legal documents. The medium of agency doesn’t change the liability allocation. If anything, AI agents create more exposure because their scope of authority is often poorly defined and their actions are harder to monitor.

When you deploy an agentic AI system, you’re making an agency appointment. You’re delegating authority to act on your behalf. The fact that you did it through a configuration file instead of an engagement letter doesn’t change the legal character of the relationship. And just like with human agents, you remain liable for what they do within their delegated authority, whether you specifically authorized each action or not.

Agentic vs. Agent-ish

The term “agentic” gets misapplied to everything with a chat interface and a ‘for-loop.’ Let’s be precise, because the distinction determines your exposure.

Agentic systems take objectives and autonomously determine execution. They plan, act, and adapt based on context. If you stop typing, they keep working toward the goal. They don’t wait for permission at each step. They operate within delegated authority until they hit an escalation trigger you’ve defined.

Agent-ish systems chain tasks together but remain fundamentally reactive. They execute predefined workflows or respond to explicit prompts. Remove the human steering and they stop. They’re sophisticated automation, not autonomous actors.

The distinction maps to familiar legal roles. Agent-ish is like a paralegal with a detailed checklist. You assign each task explicitly, review the work, then assign the next task. Efficient but requiring constant supervision. Agentic is like a junior associate with limited authority. You set the objective (”draft the motion, pull exhibits, format for filing”) and they determine the sequence, escalating judgment calls as needed.

The test is simple. If you stop typing, does it keep advancing the work?

Agentic acts. Agent-ish assists. That difference determines whether you’re supervising a tool or managing an agent relationship.

The Authority You Delegate Defines the Liability You Own

Here’s where lawyers’ professional training should provide an advantage but somehow doesn’t. We understand that authority and liability travel together. When you give an agent authority to act, you accept responsibility for their actions within that scope. Narrow the authority, limit the exposure. Broaden the authority, accept the risk.

AI agents follow the same principle with a dangerous twist. The authority you delegate is defined by system configuration, not clear instructions. An AI agent with read access to your document management system has authority to access everything in that system. Whether you intended it to search privileged communications or only review contracts is irrelevant. You gave it access. That’s the delegation.

The Clawdbot prompt injection demonstrates this problem. Users delegated authority to process email and execute commands. They didn’t specifically authorize credential exfiltration. But the authority they did delegate was broad enough to encompass those actions when an attacker provided the right instructions. The agent stayed within its technical permissions even as it violated its principal’s intent.

In traditional agency relationships, we manage this through clear scope definitions, regular oversight, and aligned incentives. Your associate knows not to disclose privileged information even though they have access to it. Your paralegal understands confidentiality obligations. AI agents have no such internalized constraints. They have permissions and instructions. That’s it.

The Clawdbot Failure Modes (And Their Legal Parallels)

Clawdbot’s failures aren’t hypothetical edge cases. They’re predictable consequences of agentic design meeting inadequate governance. Each maps directly to legal practice vulnerabilities.

Spoiler Alert -- This is a bit technical, jump to the next section if you do not care.

Misconfigured exposure happened when users placed Clawdbot behind reverse proxies that treated public internet traffic as localhost, bypassing authentication. Anyone could hit the control panel, view configuration, trigger commands. For lawyers, substitute your AI contract analysis tool exposed to the internet through VPN misconfiguration. Opposing counsel sends a document for review. Your agent processes it, extracts strategy notes from prior matters, and helpfully includes them in the analysis. You just waived privilege through technical incompetence masked as efficiency.

Prompt injection leading to credential exfiltration was Archestra’s elegant demonstration. Send content the agent processes, inject instructions that redirect normal functions. For legal AI, the attack vector is any uploaded document. An adversary embeds instructions in metadata or hidden text. Your agent, designed to be helpful and operating within its delegated authority, extracts confidential information from your document management system and incorporates it into the output. You’ve disclosed protected work product because your agent couldn’t distinguish legitimate instructions from malicious ones. The agent had authority to access those files. It used that authority. You’re responsible.

Plaintext credential concentration meant Clawdbot stored API keys, OAuth tokens, and conversation logs in predictable plaintext files. Infostealer malware began targeting these locations within days. Legal AI agents require credentials for document systems, research databases, client portals, email. Concentrate those in plaintext storage and you’ve created a single point of catastrophic failure. One compromised endpoint exfiltrates credentials for every system your firm uses. Every client matter potentially exposed through one security failure.

Unvetted skills supply chain let Clawdbot users install community-contributed “skills” that extended the agent’s capabilities. A researcher uploaded a benign skill, inflated download counts, and watched developers across seven countries install and execute it with full trust. Legal AI platforms increasingly offer plugin ecosystems and third-party integrations. Each one is a potential supply chain attack vector. That contract analysis plugin you installed might be exfiltrating client data while performing its advertised functions perfectly. You delegated authority to the plugin when you installed it. You own what it does.

AI Agents Have No Fiduciary Duty (And That’s the Problem)

When you delegate authority to a human agent, multiple safeguards operate simultaneously. The agent owes you fiduciary duties. They face professional consequences for misconduct. They have career incentives aligned with your interests. They exercise judgment that incorporates unstated but understood constraints. Your paralegal knows not to disclose privileged information even when technically authorized to access it.

AI agents have none of this. No fiduciary duty. No professional liability. No reputation to protect. No internalized understanding of legal privilege or confidentiality obligations.

Best Practices a.k.a. Governance for Agent Relationships

The more autonomous your agent, the more rigorous your controls must be. Keep in mind that when you adopt an agentic workflow, you’re managing an agency relationship with an entity that has broad authority, no judgment, and no fiduciary obligations. If that sounded scary, it should.

1. Minimum necessary authority. Give your AI agent minimum authority required for its specific function. For example, Contract analysis gets access to the contract repository only, not the entire DMS, not email, not work product folders. Research gets read-only access to research databases, not client files.

2. Start small, fail safely. Do not start with legal research, strategic analysis, or client advice – those are all things that AI is *not* good at. This is where you add value as a lawyer.

3. Use small, narrow agents. Build multiple narrow agents instead of one agent with expansive ‘god-mode’ permissions. If an agent is compromised, the breach should be contained to that agent’s limited scope, not cascade across your practice, exposing client confidentiality, or work product privileged material. If you can’t audit the code or verify provenance, don’t deploy it with client data.

4. Explicit escalation triggers. This is just a fancy way of saying “define when the agent must ask for human review.” Don’t allow autonomous judgment on matters requiring professional discretion. For example, any action involving client communication, court filings, or legal conclusions requires explicit human approval.

5. Comprehensive audit logging. Run audits and keep audit logs. This will keep you in control, and it creates the record you’ll need when things go wrong.

6. Credentials Separated. Make sure your AI agent doesn’t have access to your encrypted storage. Keep your most confidential information in storage that your AI agent doesn’t have access to.

7. Vetted integrations only. Before giving an AI agent access to your system, either prohibit access to the app’s you’ve integrated or make sure you know what will happen—worst case—when your AI agents goes live. This is a preventable vulnerability that is often overlooked.

8. No access to public internet. If you are new to an AI agent, one of the simplest and easiest to implement controls is, ‘don’t allow access to a public internet connection.’ This will go a long way in keeping your own information safe.

9. Human-In-Control. Make oversight practical rather than theoretical. If the agent cites cases, it provides direct links to verify them. If it analyzes contracts, it surfaces the specific language being analyzed. Don’t rely on post-hoc review. Build verification into the workflow so people will actually do it instead of rubber-stamping output.

Your Ethical Obligations Haven’t Changed

Model Rule 1.1 requires competence. Model Rule 1.3 requires diligence. Model Rule 1.6 requires confidentiality. Model Rule 5.3 requires supervision of non-lawyer assistants. These rules contain no AI exceptions and no technology carveouts.

When you deploy an agentic AI system, you remain responsible for competent output (”the agent hallucinated that case” is not a malpractice defense), client confidentiality (every input to your agent is a potential disclosure, every vulnerability a potential breach), adequate supervision (you can’t supervise what you can’t audit), and work product protection (AI-generated documents carry metadata that might undermine privilege, and compromised agents can exfiltrate privileged material).

Agency Law Still Applies

Agentic AI offers genuine value when deployed with appropriate controls. The technology enables you to delegate routine execution while focusing on strategy, judgment, and client counseling—all the things that machines can’t do. But delegation without governance is negligence, and lawyers should know this better than anyone. Agency law applies whether your agent is carbon-based or silicon-based.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Amy Swaner, JD AIGP

Founder and CAIO at Lexara, specializing in AI Governance, Ethics, and Risk Management

3 Biggest Takeaways:

1. per-seat licensing for our legal subscriptions is under some serious structural pressure,

2. commoditized legal work is increasingly automatable, and

3. AI’s mere existence might cause you to have to defend your fees.

What Happened -- the SaaS-pocalypse

On January 30, 2026, Anthropic — the company behind the Claude AI model — released a set of open-source plugins for its desktop AI tool, Claude Cowork. One of them handles legal contract review. It can triage NDAs, flag nonstandard clauses against a negotiation playbook, and generate compliance summaries.

The plugin is open source meaning anyone can read, modify, or use the source code that created it. When people read it, they found roughly 200 lines of structured markdown (eg a table). It’s essentially first-year law school concepts organized with workflow logic and a prompt structure. It’s got a disclaimer that all output should be reviewed by licensed attorneys. Which all attorneys should know by now, but we still keep seeing problems.

Within 48 hours, the market responded:

• Thomson Reuters posted its largest single-day stock decline on record, falling approximately 16%.

• RELX, parent company of LexisNexis, dropped roughly 14%.

• LegalZoom fell approximately 20%.

• Private equity firms with heavy professional-services exposure -- Ares Management, KKR, TPG and Blue Owl — each fell around 10%.

In aggregate, the sell-off erased an estimated $285 billion in market capitalization. Financial media quickly branded it the “di-SaaS-ter”, and the “SaaS-pocalypse.” See eg, The Street, Yahoo!Finance, and Inc.

Why An Open Source File Is Causing So Much Chaos

The plugin itself didn’t justify that reaction. Any competent prompt engineer-- or, candidly, any tech-literate lawyer with a weekend to spare--could assemble something functionally similar. The market wasn’t reacting to the plugin. It was reacting to what the plugin made possible.

The entire enterprise software economy, from Salesforce to Thomson Reuters, is built on per-seat licensing: every human who touches the tool pays a license fee. That model works when humans are the bottleneck. Each human needs their own login. But it breaks when an AI agent can perform the work of multiple humans without requiring multiple logins.

If one AI agent can do the legal research that previously required ten paralegals with ten separate Westlaw subscriptions, Thomson Reuters’ case law database doesn’t lose any of it value. But it loses nine seats of revenue. Ironically the data becomes more important in an AI-driven world -- it’s the fuel the agents run on. But the per-seat pricing model that monetizes that data is structurally unsound.

The market had been quietly signaling this for months. Software-sector forward price-to-earnings ratios had been compressing. Companies were missing revenue estimates at rates not seen since the post-COVID correction.

More AI Doesn’t Mean Less Software

NVIDIA CEO Jensen Huang offered the strongest counterargument at the Cisco AI Summit shortly before the sell-off. His position is essentially this:

AI doesn’t replace software; AI runs on software.

More AI agents means more databases, more APIs, more middleware.

Every agent that replaces a paralegal still needs Westlaw’s data, a CRM, and document management.

AI should increase total software demand.

Which makes sense. Huang isn’t wrong, but he’s not making the persuasive case he thinks he is. Nobody serious contends that the world needs less software. The contention is that the world no longer needs to pay for software the way it currently pays for software. Huang is defending the product. The market is attacking the pricing model. Those are different things, and confusing them could be how SaaS giants lose their edge.

Consider the newspaper analogy we so often turn to when trying to explain the impact of AI. It’s not perfect here, but it is instructive. Print media had content people wanted -- local reporting, investigative journalism, weather. The internet didn’t make that content worthless. It destroyed the access model, and to some extent, the pricing model. You no longer had to buy an entire newspaper to get the one section you cared about and that advertisers would pay premium rates to reach readers with no alternative. The content survived. The business model didn’t.

The Market Sell-Off Explained By An Accounting Firm

While the market was fixated on Thomson Reuters’ share price, a quieter story broke that received far less attention. But it tells us so much more about where we’re headed.

KPMG, one of the Big Four accounting firms, pressured Grant Thornton UK, its own auditor, to cut audit fees. KMPG’s rationale was that AI reduces the cost of performing audit work, and those savings should flow to the client. Grant Thornton initially resisted, arguing that high-quality audits require expert human judgment and that fees reflect the cost of the workers (a/k/a the humans). KPMG’s response, per the Financial Times, was lower your prices, or we’ll find a new auditor. Grant Thornton lost this game of chicken, and the fees dropped approximately 16%.

This matters more than any stock chart because it’s an operating event, not a market event. A real company used AI’s existence -- not its use, not its deployment, but its very existence -- as leverage in a real fee negotiation to extract a real price concession.

How long before other legal clients follow suit?

Why Legal Is Ground Zero

The legal profession is more exposed to this dynamic than almost any other knowledge-work sector, for three compounding reasons.

The data moat is thinner than it looks. Thomson Reuters and LexisNexis have operated what amounts to a duopoly on legal research for decades – ever since I’ve been practicing law. But unlike Salesforce’s proprietary customer data or SAP’s enterprise resource planning logic, the underlying data in legal research -- case law, statutes, regulations -- is public record. That’s right. These companies are monetizing public information. They add proprietary organization, search functionality, and editorial enhancements. Their organizational model alone has survived lawsuits. That’s a real value-add, but it’s a weaker moat than proprietary data. An AI agent that can efficiently search, synthesize, and cite public legal sources puts direct pressure on the premium these platforms command.

Commoditized legal work is immediately vulnerable. NDA review, due diligence document review, regulatory compliance checklists, standard contract drafting, discovery review; these are high-volume, pattern-recognizable tasks that AI handles competently today. They also represent a significant share of associate and paralegal billable hours at many firms. The Anthropic plugin demonstrated, in 200 lines of open source code, that basic contract review doesn’t require a Westlaw subscription or a first-year associate. It requires structured prompts and a competent model.

The fee-negotiation pressure is already here. Corporate legal departments and procurement teams don’t need to be actively using AI to use it as a lever. They need only point to its existence. Then they pattern their conversation on KPMG’s conversation. It’s pretty straightforward: “So, we know AI can perform first-pass contract review, document summarization, and basic legal research. Your staffing model assumes associates and paralegals doing that work at hourly rates. Justify your rates.” If it isn’t happening in your practice yet, it almost certain will be.

What This Does NOT Mean

Make no mistake -- this is not a story about lawyers being replaced. AI never has been that story. It is a story about how legal services are priced and delivered.

The gap between what a client asks for and the full universe of knowledge needed to do it well is acute in legal work. A client saying “review this contract” provides perhaps just a small fraction of the information a lawyer needs to accomplish the task. Risk tolerance, deal context, jurisdictional nuances, relationship dynamics, business objectives. That implicit knowledge is the actual value a skilled lawyer provides, and no markdown file can replicate it.

The accountability edge is equally durable. Legal is a regulated profession with malpractice liability, ethical duties, fiduciary obligations, and bar oversight. When an AI hallucinates a case citation as happened in Mata v. Avianca, someone is liable. Enterprises need a “ringable neck,” someone who can be accountable when something goes wrong at 2:00 a.m. before a filing deadline. Preferably someone with a generous E & O carrier. That accountability layer becomes more valuable as AI-driven workflows grow more complex, not less. Which is not at all comforting for lawyers, that one of our value-adds is to serve as a backstop for accountability when something goes wrong.

But this does expose a huge problem with the billable hour pricing model, and the assumption that legal work scales linearly with the number of humans billing hours against it.

What You Should Be Thinking About

If You’re in Private Practice

The firms that will thrive are those rethinking what work gets done, by whom, at what price point, and with what technology -- not those running the same staffing model with a chatbot added in for good measure.

You’ve got some time, but you should be thinking about it to get ahead of the pressure. You need to be able to defend your pricing when clients use AI’s existence as leverage. And that’s true whether or not you are using AI in your practice, as we saw in the KPMG example, above.

If You’re In-House

You now have a credible basis to renegotiate outside counsel rates on any work that is high-volume and pattern-recognizable. You also have an obligation to understand the ethical and competence implications of AI tools your teams may already be using.

If You’re Advising Clients on AI Strategy

The SaaS-pocalypse is a case study in the difference between product disruption and pricing-model disruption. Your clients’ software vendors-- not just legal tech, but across their enterprise stack--are all facing variants of the same question. That’s an advisory opportunity.

Regardless of Your Role

The ethical obligations haven’t caught up. Model Rules 1.1 (competence), 1.6 (confidentiality), and 5.3 (supervision of nonlawyer assistants) all have direct implications for AI use. State bars are issuing guidance at varying speeds. Unauthorized practice of law questions around AI-generated legal analysis remain largely unresolved. And are generally overshadowed by the hallucinated legal citations that still show up altogether too frequently. This regulatory uncertainty is both a risk and, for lawyers positioned to advise on it, an opportunity.

The Bottom Line

The three biggest takeaways from this moment are first, the “per-seat” licensing for our legal subscriptions is under some serious structural pressure. Second, commoditized legal work is increasingly automatable. And third, AI’s mere existence shifts fee-negotiation dynamics. Even if you’re still not using it in your practice. This dynamics shift won’t hit you tomorrow when you walk into your office. Or even when you send bills out at the end of the month. But start considering your strategy now so you are prepared to answer questions about your fees.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Many lawyers now use AI for research, contract review, discovery, drafting, and due diligence while operating with zero understanding of the architecture determining whether those tools work. And there are lawyers who find no value in AI tools. We’ve confused knowing how to use an interface—prompt engineering--with understanding the technology producing outputs. Understanding context engineering won’t let you fix bad tools. But it will let you recognize bad tools before you stake your professional reputation on them.

Prompt Engineering vs. Context Engineering

Prompt engineering is the question you type into an AI tool’s chat interface. Prompt engineering is important and goes a long way to high quality output.

Context engineering is made up of a number of other factors that also determine how your AI tool responds. Using a legal analogy, prompt engineering is like writing the argument section of your brief. Context engineering is assembling the entire record.

Imagine you are preparing for oral argument. You select which exhibits to use, decide which expert testimony to proffer, highlight portions of depositions, and prepare your bench memo. If you want to win, you don’t select random case citations, leave out expert testimony, and bury your best piece of evidence. You wouldn’t cite cases without checking whether they truly support your proposition. Ok, well most of us wouldn’t.

AI tools work the same way, just with a different decision-maker. The model is your fact-finder / judge. Your prompt is your argument. Context is everything else you’re providing to help the judge reach the right conclusion. Even a perfect prompt can’t save bad context engineering every time.

The difference between your law practice in this analogy and your AI tool is visibility. In litigation, you see your entire record. You made the choices about what to include and how to structure it. With AI tools, a great deal of context engineering happens invisibly in the background. The interface shows you a simple text box for your prompt and a response. You don’t see the retrieval ranking, the document chunking, the example selection, the system constraints—all the machinery operating behind the scenes, all impacting what you get back.

That invisibility creates the illusion that prompts are all that matter. We see the prompts because we write the prompts. But other factors are at play; some you can control, many you cannot. One of those factors is the context window.

A Context Window

A context window is the total amount of text—measured in units called tokens—that an AI model can process and consider at any one time. Everything outside that window is invisible to the model, regardless of its relevance or importance. Context windows have expanded dramatically in the three years AI tools have been popularly available and are still moving fast. Here’s where things stand as of early 2026, for consumer tools:

• Claude currently offers 200,000 tokens standard, with 1 million tokens available in beta.

• ChatGPT-5 features 400,000 input tokens with a 128,000 output window.

• Google’s Gemini 2.5 Pro and Flash both support a 1 million-token window.

• Meta’s Llama 4 Scout features a 10 million token context window.

For reference on what those numbers mean, 128,000 tokens is roughly the length of a 250-page book. A million tokens is several thousand pages. A typical 200-page buy-sell agreement sits around 100,000 tokens.

Think of a context window as the desk space available to a very fast, very capable law clerk. Everything on that desk—your contract, the relevant precedents, your instructions, the firm’s drafting guidelines—is what the clerk can actually work with at any given moment. Anything that doesn’t fit on the desk simply doesn’t exist for that clerk, no matter how critical it might be. A 200-page credit agreement, a stack of precedent memos, and your detailed instructions might collectively exceed the desk space available, which means something gets left in the hallway. Context engineering is, at its core, the discipline of deciding what stays on the desk and what doesn’t—and for legal work, that decision determines a great deal.

______________________________________________________

Above is a visual representation of a context window for a Claude Code session, with a context window of 1,000,000 tokens. The small squares on the left plus the round icons above them are a visual representation of a context window. The purple icons are token blocks, representing how many tokens have been used out of the context window. You can tell from the legend on the right that some tokens are used up by the system prompt (set by the AI tool creator / engineers). Some of the context window is used by skills, system tools, and in this specific case, custom agents. All of these together are part of a context window.

As the user you are limited to the purple icons and squares as your ‘workspace.’ This looks vast, but the AI tools you are using have significantly smaller context windows.

Context Engineering, In Legal Scenarios

Context engineering is the systematic design of all inputs provided to LLMs beyond your immediate question. It includes how information gets selected for the model to consider, how that information gets structured and chunked, what examples shape the model’s behavior, what constraints define its role and scope, and how limited processing capacity gets allocated across competing needs. I won’t go into the technical components such as retrieval system design, ranking algorithms, etc. because I can feel your eyes starting to glaze over. The conceptual core is simpler recognizing that the model’s entire input environment determines output quality at least as much as the model’s underlying capability.

Think about asking an AI tool to analyze a 200-page credit agreement for indemnification issues. You type “identify indemnification problems” and upload the file. Simple enough. But “something” has to decide which parts of that agreement the model actually processes, in what order, with what surrounding context.

Section 8.3 might reference “limitations in Section 12.5.” Does the model see both sections together, or does the chunking algorithm sever that relationship? Are your firm’s precedent indemnification provisions included for comparison? Does the system know Iowa law governs, or is it applying generic commercial standards? When the context window fills up, does critical material get truncated while boilerplate remains?

Those are context engineering decisions. They happen whether you and I and every other lawyer using AI tools thinks about them deliberately or not. The only variable is whether they’re made well or made badly, intentionally or accidentally.

For contract review, part of context engineering is the chunking strategy. Chunking is the process of breaking large documents into smaller sections that an AI model can process. The boundaries where those breaks occur matter enormously—a provision severed from the cross-reference it depends on is like a contract missing its exhibits. Good chunking preserves the architecture of legal documents (section headers, definitions, cross-references) while bad chunking treats text like a word processor cutting pages at arbitrary margins.

For legal research, context engineering determines whether state Supreme Court decisions rank ahead of out-of-state dicta. Whether recent cases surface first when doctrine is evolving. Whether the model gets enough factual context to distinguish truly analogous precedent from superficially similar but irrelevant decisions.

For due diligence, context engineering determines whether retrieval prioritizes smoking-gun documents over background noise. Whether the system understands hierarchical relationships between disclosure schedules and main agreements. Whether client risk parameters get incorporated without compromising confidentiality.

Same model, different context engineering, radically different results.

The funny thing about the image of the burning $100 and the words next to it is that it’s a prime example of context windows and how important it is to control them to the extent possible. I went to ChatGPT to have it create a quote for this article, using the wording I pasted in. I did not ask for the burning money. Because the image was in my context window, ChatGPT used it to create the above graphic. Here is the chat that led to this image:

I didn’t mention the burning money when I asked for an image for the quote. But when I said I need. “this” ChatGPT conflated the instructions with what was already in this chat’s context window. An inadvertent, but useful, example of context with AI tools. The lessons are to be specific when giving instructions, and to be aware that what’s in your current chat will form part of the context window for whatever you’re asking.

The Unfortunate Part – What You Cannot Control

Lawyers generally appreciate control. Being able to manage a given situation is important to us. Unfortunately, you can’t control the entire context engineering in the AI tools you’re probably using. Not unless you’ve had them customized for your use.

ChatGPT, Claude, Copilot, Gemini and other consumer AI tools let you write prompts and upload documents. That’s pretty much it. You can’t modify chunking algorithms. You can’t change retrieval ranking. You can’t see or edit system prompts. You can’t control what examples the model processes. The interface hides all of it.

Legal-specific tools like Westlaw AI, Lexis AI, CoCounsel, and Harvey give you slightly more control, maybe. Upload documents to matter workspaces. Set some basic filters. That’s usually the limit. You’re still subject to vendor context engineering decisions about chunking, ranking, and architecture.

Enterprise contracts with custom configurations might let firms upload precedent libraries, adjust some retrieval settings, or specify output formats. Even then, you typically can’t touch core architecture—the chunking algorithms, base system prompts, or ranking weights that determine whether the tool works well for legal documents. Unless you hire an expert to make modifications.

So if you can’t control context engineering, why does understanding it matter?

You Still Need to Understand It

Understanding context engineering gives you the advantage of significantly more high-quality responses from your AI output.

First, More Effective Use of AI. Recognition of what the problem is and what’s causing it matters because it changes how and when you use AI. Instead of assuming all AI tools are equally unreliable and avoiding them entirely, you understand that some tools fail because of fixable context engineering while others have architectural problems that make them unsuitable for legal work regardless of prompt quality. Understanding limitations and capabilities makes AI significantly more useful.

Second, Professional Responsibility. ABA Model Rule 1.1, Comment 8 requires maintaining competence regarding the benefits and risks of relevant technology. You can delegate execution but not understanding. When a court asks how your AI tool reached a conclusion and your answer is “I don’t know, I just used what the firm bought,” that sounds to me a bit like incompetence. You need enough literacy to evaluate whether tools are suited to your tasks, recognize when outputs are unreliable, and explain your quality assurance process when questioned, especially if you’re questioned by the court.

Third, Vendor Evaluation. Someone at your firm is evaluating AI tools, negotiating contracts, setting AI policies. If nobody understands context engineering, those decisions get made based on price, brand recognition, and whatever the sales demo emphasized. The actual architecture determining output quality never gets evaluated because nobody knows to ask about it. Vendors claim their AI tool is “optimized for legal work” or “trained on legal data” or “purpose-built for law firms.” Those phrases mean nothing without understanding context engineering. Optimized how? Trained on what? Purpose-built with what architecture?

Understanding context engineering gives you the vocabulary to ask questions that expose substance versus marketing. Does their chunking preserve legal document structure? How does their retrieval handle jurisdictional hierarchy? Can you see their system prompts? Do they maintain audit trails? These questions separate serious vendors from the smoke and mirrors of glossy advertising. Part 2 of this article gives you questions you can ask vendors.

Context Engineering to Improve Your Output

You saw the unfortunate parts about context engineering, and how little we users can control it. Better prompts won’t fix bad chunking. Better prompts won’t change retrieval ranking, expand context windows or improve cross-reference handling.

But never fear, because there are simple techniques that don’t require you to understand a chunking strategy or retrieval ranking. Adopt these today to make sure you are making the most of context engineering constraints.

8 Best Practices for Using Context Engineering to Your Advantage

1. Don’t Mix Chats. Keep each matter, project, or task in its own conversation thread rather than bundling unrelated work into one sprawling session. Mixing chats pollutes the context window with irrelevant material, diluting focus the same way a cluttered trial exhibit binder dilutes yours.

2. Use GPTs, Projects, and Workspaces. Take advantage of your tool’s built-in organizational features to create dedicated spaces for specific matters or practice areas. These features pre-load relevant context and keep your documents organized in ways the AI can actually access—think of them as your AI’s filing system. Not sure how to set up a custom GPT? Learn how in less than 10 minutes.

3. Give Positive Reinforcement and Specific Feedback. Tell the AI when it gets something right (“that’s exactly the format I need”) and redirect with precision when it doesn’t (“the risk levels need to be more granular”). Positive feedback anchors good behavior within the conversation while specific corrections steer outputs toward your standards without wasting context on repeated failures.

4. Delete Old Documents. Remove documents from your workspace or conversation that no longer serve your current task. Old documents consume valuable context window space, quietly crowding out the material that actually matters—like briefs nobody asked for, taking up space in a judge’s chambers.

5. Summarize Long Documents, Then Delete the Originals. Ask the AI to summarize lengthy documents first, then work exclusively from those summaries. Summaries preserve substance while freeing context window capacity for the analysis you actually need—hello efficiency without sacrifice.

6. Start a New Thread. On an especially complicated matter, or if your context window is low, start a new, clean thread. You can import the summaries mentioned in #5 above into it. Deleting old documents won’t guarantee that they’re removed from context, and it may not reduce the current context window.

7. Point Your AI to the Right Material. When working with multiple versions, meeting notes, or memos, explicitly reference which one applies to your current question rather than leaving the AI to guess. Undirected tools default to whatever context surfaces first, which is rarely correct.

8. Use Exemplars. To save context window space, it can make sense to include an exemplar, or ideal example of what you want the AI tool to create. This takes advantage of a technique called “few shot learning.” Note if the exemplar is extremely long, contains a lot of graphics or special formatting, this technique might backfire on you and take up too much of your context window. Be mindful if employing this technique.

What Comes Next

Understanding context engineering matters because it transforms how you use AI tools, but also how you evaluate and select AI tools. You can’t engineer context in most tools, but you can use best practices to take advantage of the context engineering you’re stuck with.

My next article addresses vendor evaluation specifically:

• How to expose context engineering quality during demos

• What questions reveal architectural substance versus marketing smoke

• What contract terms and testing protocols ensure you’re buying tools that can actually work for legal applications

A basic understanding of context engineering (this Article), along with some specific questions and tests that help you with tool evaluation (next Article) requires understanding what you’re evaluating. And the better you understand AI tools, the better shape you’re in to make the most of the AI tools you use.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

In the beginning of GenAI in law, there was a hope among some—including me--that widespread access to artificial intelligence would reduce legal costs, expand access to justice, and level a playing field that is noticeably tilted toward those who can afford $800-an-hour legal counsel. Technology could deliver what pro bono hours and legal aid budgets could not—affordable legal help for the 92% of civil legal needs of low-income Americans that go unmet. That hope skipped over optimism and landed directly in the category of naïveté.

Three plus years into the generative AI boom, here’s the reality:

The efficiency gains of AI are real. The cost reductions in legal services are not.

The Profit Paradox

Axiom’s relatively ancient 2024 study of 600+ senior legal leaders across eight countries reveals the mechanics of a profit paradox: 79% of law firms now use AI to boost efficiency. Only 6% pass those savings to clients (summarized in this July 2025 Axiom blogpost). Better still—if you’re a partner—34% charge premium rates for AI-enhanced work. Id.

I’ve never been amazing at math, but these equations look quite elegant. An AI tool completes in two hours what previously took ten. The client still pays for ten or maybe pays a premium for “cutting-edge AI-enhanced service.” The associate bills less. The partner pockets the spread. Corporate legal departments, already squeezed, find themselves funding their outside counsel’s AI transformation while seeing none of the financial benefits. It’s no surprise that inhouse counsel’s adoption of GenAI dwarfs regular law firms’ adoption, since the inhouse teams can show the cost savings from AI efficiency gains.

Opinion 512’s Effect (Or Lack Thereof)

But what about Opinion 512 you ask? Doesn’t that force downward pressure on legal bills if we are obligated to only bill for actual time, and can’t bill for AI tool costs without disclosure to the client? True, if billing hourly Opinion 512 says lawyers “must bill for their actual time” and may not bill “for more time than [they] have actually expended.” The problem is that we aren’t seeing lower legal fees. Corporations wonder why their bills from outside counsel haven’t been reduced by AI efficiency gains.

There is a dearth of evidence that legal fees have gone down appreciably. What I found instead is evidence that despite legal’s adoption of AI tools, there’s no sign that legal rates are going down. In BigLaw, where AI adoption is highest, pricing keeps climbing. According to one report, billing at AmLaw 100 firms jumped 8.3% going into 2025. Recent data from a Wells Fargo survey reported that the 200 largest US firms saw revenue grow roughly 13% in 2025 as billable rates rose nearly 10%. Top 50 firms’ rates were up 10.4% in a single year. Commentary suggests the increase was driven by rate hikes, not increased demand.

Market discipline prevents voluntary repricing even among the most well-intentioned law firms. Cut rates too aggressively and you signal either desperation or an admission you’ve been overcharging for years. Neither plays well at lateral recruiting dinners or client pitches. Better to maintain rates, improve margins, and deploy AI as a competitive moat rather than a client gift.

The result is wealth concentration that would make John D. Rockefeller blush. AI is enriching the biggest firms. AI also delivered around 7%+ household wealth gains (per Oxford Economics), but those gains flow upward—to shareholders of legal tech companies, partners capturing efficiency spreads, and corporate clients who’ve built internal AI capabilities to bypass outside counsel entirely. Hence, the K economy.

The ‘Special’ K Economy

No disrespect to Kellogg, we’re in a ‘special’ K economy. The letter K has two branches diverging from a common stem. One ascends; one descends—never to meet again. Post-2008 financial crisis, economists noticed recovery wasn’t uniform. High-income households and white-collar workers rebounded quickly (ascending branch). Low-income workers and service industries stayed depressed or declined further (descending branch). The shape of their respective trajectories, when plotted, resembled a K. COVID accelerated the pattern. Tech workers Zoomed meetings from home while service workers lost jobs, burned savings, faced eviction, and hardly saw an increase in their base pay. Same pandemic, opposite outcomes. The branches diverged sharply.

Contrast the K economic recovery with other recovery shapes

Oxford Economics CEO Ian McFee offers this insight: AI doesn’t create a V (rising tide lifts all boats). It creates a K. And that K stays locked for a decade minimum—the time required for productivity gains to trickle down to workers whose labor AI can’t replace. The K is pernicious because there’s no collective recovery. No celebration to rally and unify. Some households celebrate record quarters while the others look for the local food bank. There is no “economy” that we’re all experiencing together.

The K-Shaped Economy Comes to Law

Oxford Economics projects the AI-driven wealth divergence will persist through 2035. Legal services mirror the greater economy: AI delivers efficiency gains, but capital captures them first—and longest. The top 0.1% saw wealth grow 281% from 2010 to 2025, reaching $24.89 trillion. The bottom 50% grew faster in percentage terms (1,189%) but still hold only $4.25 trillion combined. Six times less than the wealthiest one-tenth of one percent. Id.

The Upward Branch of the K

BigLaw partners, corporate general counsel, and legal tech investors ride the ascending branch of the K. EDiscovery is a prime example. Document review that cost $200,000 now runs $30,000—but clients rarely see the whole $170,000 savings. Firms either maintain rates (billing for value rather than hours) or charge premiums for AI-enhanced service, or in most cases, land somewhere in the middle. Regardless, profits per partner rise rather than lower.

According to a recent Forrester study commissioned by LexisNexis, corporate legal departments deploy AI to reduce outside counsel spend by 13%, keeping work in-house. That is a tidy savings. One recent article calls AI ‘”the hottest cost-cutting tool in corporate legal departments.” General counsel become budget heroes. The savings flow to shareholders, not consumers.

Consider the incentives. The equity partners at Axiom’s surveyed firms can see that technology makes labor 5x more productive, but don’t cut rates by 80%. They attempt to capture as much of the spread as possible.

The Downward Branch of the K

Meanwhile, on the descending branch the 92% of unmet civil legal needs remain unchanged for low-income Americans who still can’t afford representation. Eviction defense, family law, debt collection—the legal needs that AI could democratize have diverged out of reach.

The promise of consumer-facing AI tools (DoNotPay, AI Lawyer Pro) runs into the familiar obstacles of quality, liability, and unauthorized practice restrictions. The tools that actually work require legal sophistication to use effectively. Raise your hand if you haven’t heard Professor Scott Galloway’s famous/infamous quote “AI won’t take your job; someone using AI will.” AI is a great tool to assist lawyers but cannot replace lawyers. We see daily examples of that. Pro se litigants using AI to assist in their legal claims often receive advice that ranges from passable, to oversimplified, to dangerously wrong.

And so those who can afford legal help get AI-efficiency. But those who need it for dire reasons but can’t afford it get chatbots with wrong or questionable answers. Unfortunately, they often don’t have the knowledge or expertise to check on the veracity of the answers.

The Hollowed Out Middle of the K

Oxford Economics CEO Innes McFee warns AI will “hollow out” middle-skilled jobs—the roles where tasks are routine enough to automate but not so physical they require human hands.

Law schools still graduate around 35,000 JDs annually. What happens when there are too many lawyers for the work that is taking less time thanks to AI? The least trained are the easiest to replace with AI because AI is most effective at the lower-level, repetitive work. AI cannot replace the judgment and relationship-based work that partners and some senior associates do.

The Timeline

McFee’s projection is that the K economy persists until at least 2035. We need a decade for productivity gains to reach low-skill workers before the upward and downward branches converge. AI is not going anywhere, so that convergence requires AI to either (1) dramatically increase wages for non-automatable work, or (2) reduce costs so substantially that services become affordable despite stagnant incomes.

In legal services, neither path looks likely. Wage pressure on court-appearance lawyers will come from the surplus of JDs competing for non-automated work. And cost reductions require firms to voluntarily surrender margin. The billable hour makes that choice optional.

How the Branches Eventually Converge

AI will push legal fees down eventually through oversupply. Economics 101 taught us that when you need one-fifth the labor to produce the same output, four-fifths of your labor force is hunting for work. Desperate lawyers will be willing to discount their services.

For example, let’s imagine a mid-size firm that employs 40 associates and generates $40M in revenue. If that same firm could do the same work with only 20 associates—plus AI subscriptions—to hit the same revenue, partners could keep all the lawyers and find more work, thereby increasing the margins, or let 20 associates go, also increasing margins if they can figure out how to bill the time saved. The 20 displaced associates don’t evaporate. They hang their own shingles. Or they join contract attorney platforms. And they undercut established rates because $100/hour beats unemployment.

But all that market-adjusting pressure takes time. Law school classes won’t shrink fast enough to prevent a glut, and AI will continue to improve, making the surplus grow. That results in market pressure only gently, slowly easing prices down.

Wealth convergence will require productivity gains to reach non-automatable workers. In law, that’s the court-appearance attorney, the client hand-holder, the human who must physically show up. Their wages actually rise when there’s scarcity.

We’ll also see a surplus of credentialed lawyers competing for shrinking associate positions, flooding into solo practice, undercutting each other to survive. That surplus leads to a buyer’s market.

The top 200 firms will remain largely insulated. Their clients don’t buy legal services—they buy insurance against catastrophic outcomes and relationships with power. They are not looking for and do not want the cheapest legal fees. They want the lawyer who has a commissioner of the SEC on speed dial, or the partner who golfs with a cabinet member.

Wealth begats wealth. The wealth effect matters. When your assets appreciate, you feel richer. You spend more. You hire more lawyers—perhaps at premium rates—to structure investments, minimize taxes, and handle sophisticated transactions. The economy becomes increasingly driven by the financially well off.

Plus, BigLaw operates in oligopoly. Clients can’t easily substitute for cheaper firms. Partner laterals maintain pricing discipline better than OPEC maintains production quotas. AI makes these firms more profitable, not cheaper. So, the branches will never converge.

Where Convergence Will Happen

Mid-market and below—where clients have options and services commoditize, we will see legal fees go down. Real estate closings. Straightforward business litigation. Estate planning for the ‘merely’ affluent. Employment disputes. Contract drafting without nine-figure consequences.

This might benefit small and solo firms most. AI-powered solo practitioners and boutique firms can afford to price their time at $150/hour instead of $350 because their cost structure allows it. They can use virtual offices for virtual meetings and even employ virtual legal assistants. They don’t carry the heavy overhead load of marble-floored offices and inhouse dining.

Another source of pressure is AI adoption by what used to be ‘legal form providers’ like LegalZoom and Rocket Lawyer. They are already pulling the lowest dollar simple consumer work out of the pipeline. And as they incorporate high quality AI, they will continue to pull more and more complex consumer and small-business work away from real live lawyers.

Law firms follow the money. Always have, always will. Practice groups serving wealthy individuals and large corporations boom while legal aid budgets flat-line. The K economy closes only when productivity gains finally trickle down—which takes time.

The Access-to-Justice Mirage

Any empirical evidence for AI expanding access to justice is at best, anecdotal. UC Berkeley’s 2024 field study —the first of its kind—showed legal aid lawyers using AI achieved better outcomes with proper support. Encouraging, but this makes existing legal aid more effective. That’s a great thing but does nothing to expand the pool of people who can afford representation.

As mentioned earlier, consumer-facing tools exist, but quality concerns and unauthorized practice limitations constrain their utility. The UK Legal Services Consumer Panel warns that “lower cost AI-enabled services which are not regulated for quality may lead to those with less resources getting a poorer service.”

A justice gap starts looking more like an uncrossable chasm. Where AI is building a bridge for corporations, all it’s doing for legal aid is handing it a longer rope. But there is hope.

The Path Not (Yet) Taken

Could AI eventually democratize legal services? Absolutely. The technology enables subscription models, fixed-fee pricing, and true automation of routine work. But reaching that future requires disassembling or rethinking the billable hour, embracing alternative business structures, and accepting that making legal services genuinely affordable means accepting lower profits. None of that happens quickly, if ever.

It’s an especially steep hill to climb when the path of least resistance is to pocket the efficiency gains (either surreptitiously or validly), keep charging the premium, and marvel at AI’s transformative potential—for partnership distributions.

The promise of AI in my mind was not only faster, cheaper, higher quality legal work, but also the possibility of rewriting the economics of justice itself. We’re getting cheaper, faster legal work, but the economics haven’t changed significantly yet.

Capital optimizes itself first.

AI transcription tools provide genuine productivity benefits, but those benefits must be pursued within the constraints that wiretap, privacy, and biometric laws impose. The litigation examined in Parts 1 and 2 demonstrates that liability turns not on whether recording occurs, but on vendor capability and economic incentives to reuse conversational data.

AI transcription creates legal risk when vendors extract, retain, and reuse conversational data. This article provides actionable guidance for each party involved in virtual meetings with AI note-takers and for lawyers using or advising on these tools.

The Five Parties in Every AI-Recorded Meeting

Regardless of how many people are invited to, or attend, a meeting with AI transcription and recording, there are at least five participants. Even in a meeting between two people. Each of these participants has certain obligations, and certain abilities. Each are addressed below.

1. The Passive Participant

The passive participant’s data is being captured, often without their knowledge or meaningful consent. Options are limited but important.

What you can do:

If you are the Passive Participant in a virtual meeting, here are some steps you can take to protect yourself if you do not want your data including your voiceprint and image collected and used to train AI models:

• Check the participant list for bot names before speaking. Look for names like ‘Otter.ai,’ ‘Notetaker,’ or unfamiliar participants in meetings where you expected a specific number of attendees.

• Check the meeting application for indications of recording or transcription. Zoom, Teams, and other applications will have a visual indicator on screen, and many will have an audio prompt when joining.

• Object immediately if you are uncomfortable with recording. State clearly: ‘I do not consent to this meeting being recorded or transcribed by third-party AI tools.’

• Ask directly: ‘Is this meeting being recorded by any AI note-taking tools? Who has access to the recording?’ This should force explicit disclosure or at least show that you cared who had access to what.

• Leave the meeting if necessary. If recording continues without your consent and the content is sensitive, you are entitled to decline participation.

• Document unauthorized recordings. Note the date, participants, bot name if visible, and lack of consent. This creates evidence for potential claims.

Limitation: This list is not foolproof. In large meetings (webinars, training sessions with hundreds of participants), identifying all bots is impractical. In these contexts, assume recording is occurring unless explicitly stated otherwise.

2. The Participant Who Brings a Notetaker Bot

If you bring an AI note-taker to a meeting, you have duties to all other participants and the meeting organizer, regardless of whether you are acting without any intent to cause harm or trouble, or whether you are acting more strategically.

What You Should Do:

• Obtain permission from the meeting organizer before the meeting. Do not assume consent. The organizer may have policies, client obligations, or confidentiality concerns that prohibit AI recording.

• Notify all participants you intend to include a bot before the meeting begins. Include notice in calendar invites: ‘I will be using [Vendor Name] AI transcription for this meeting. This tool records audio, transcribes content, and [may/will not] be used to train AI models. If you object, please let me know before the meeting.’

• Notify participants what happens to captured data. This requires you to actually know and understand your vendor’s data practices. Do not assume—read the terms of service and privacy policy and do the research.

• Name your bot clearly. Use ‘Jane’s Otter.ai AI Notetaker’ or ‘Notetaker Bot - John,’ not anthropomorphized names like ‘Emily Adams’ that disguise the bot’s nature.

• Acknowledge bot use if asked. If another participant asks whether you are recording, answer honestly and immediately.

• Disable the bot if requested. If any participant objects, turn off the bot immediately or leave the meeting.

3. The Meeting Organizer

As the Meeting Organizer you control the terms of engagement and bear the majority of responsibility for ensuring the meeting complies with organizational policies and legal requirements.

What You Must Do:

• Establish and communicate recording policies. Decide whether AI note-takers are permitted, prohibited, or require advance approval. Communicate this policy when scheduling meetings.

• Notify participants at meeting invitation and at meeting start. If you are recording, disclose this in the calendar invite and verbally at the start of the meeting. Identify the specific tool, who has access to recordings, and retention period.

• Verify compliance with organizational standards. Confirm that planned recording complies with your organization’s data governance, security, and privacy policies. For law firms, confirm compliance with ethics rules and client engagement terms. If you intend to record client meetings, this disclosure should be stated in your engagement letter. Get specific consent for the meeting to be recorded. Notify the client ahead of time how the data will be used not only by your firm but also by the notetaker app. These steps are the basis of informed consent in regard to meeting recording.

• Monitor for unauthorized bots. Check the participant list for unexpected attendees or bot-like names. Challenge unidentified participants. Meeting organizers typically have the ability to expel an attendee from the meeting.

• Stop unauthorized recording immediately. If you discover a participant has brought an unauthorized bot, give them the opportunity to disable it. If they fail to do so or fail to do it in a timely manner remove them from the meeting.

• Document participant consent. Maintain records showing that participants were notified and consented, particularly for sensitive meetings (client consultations, M&A discussions, litigation strategy).

4. The Virtual Meeting Platform Providers

Most platforms provide basic recording notifications but they do not adequately distinguish between platform recording and third-party bot recording, nor do they give meeting organizers sufficient control over bot participation.

Meeting platform makers such as Zoom, Teams, and Google Meet are making an effort to provide transparency but could do better. Otter.ai is doing far less than it could to prevent unauthorized data capture. Meeting platforms are essentially the party hosts of the virtual meeting world. You would not expect to be invited to a private party, only to be ambushed by self-serving attendees or uninvited guests who were taking unauthorized images of you and recording your voice. Yet this is what meeting platforms are doing—they are allowing meeting attendee ‘guests’ to attend a meeting, capturing data and maintain it into such a persistent state that it cannot be meaningfully removed.

These virtual meeting platform creators have a disincentive to restrict AI bots since they likely benefit from captured data themselves. Both Zoom and Teams have weathered the storms of public scrutiny of how they are using the data they have gathered. It appears that the worst offender, Otter.ai, will be close behind them.

What Platforms Should Implement:

Virtual meeting platform providers should provide a far greater level of safety for those who are using their platforms.

• Bot detection and disclosure hooks. The platform should include a hook to catch notetaker bots. The hook can automatically detect when a bot joins a meeting (based on API usage, participant behavior patterns, or declared bot status).

• Identify all bots and hold them in an electronic waiting room until the bot has identified itself to all participants.

• Persistent Notification. Notification that a bot is attending a meeting should never be ‘one and done.’ People join late, miss initial notices, are distracted, or just fail to process. Microsoft Teams and Zoom both have a persistent notice that the meeting is being recorded or transcribed, a “Notetaking Agents are participating in this meeting” notice would be easy for them to add. Notetaker bots should be required to maintain persistent notification.

• Provide Meeting Organizer controls for bots. Provide organizers with the option to prohibit bots entirely, require advance approval for bots, or limit bot capabilities (e.g., allow transcription but prohibit screenshot capture).

• Persistent recording indicators. All platforms should maintain a visible, persistent banner whenever any recording is occurring—whether by the platform, a participant, or a third-party bot. And these indicators must be clear and unavoidable. Common and reputable platforms already do this.

• Easy bot identification. Bot makers should create distinctive icons—for example a robot symbol—for the bots they create. As an added layer of protection, the meeting platform should require ‘Bot’ or similar keyword in participant names.

5. The AI Note-Taker Vendors

Bot makers range from responsible vendors providing genuine productivity tools to companies engaged in systematic data extraction disguised as transcription services. The litigation in Parts 1 and 2 of this article demonstrates how the latter creates substantial legal exposure.

In our party analogy, the Notetaker Bots are the sometimes-uninvited guests that are walking around picking the pockets of the other party guests. However in the meeting context, there are greater harms than there tend to be at a party. Attendance at parties tends to be voluntary while attendance at meetings tends to be required.

Actions Responsible Bot Vendors Should Take:

Bot makers can provide transparent information on the use and training of their AI tools. And as a start, they can at the very least provide notification that the Bot is attending the meeting.

• Automatic disclosure on bot joining. When the bot joins a meeting, automatically post a message in the meeting chat: ‘[Vendor Name] is recording this meeting. We capture [audio/video/screenshots]. Data is stored [location] and [will/will not] be used to train AI models. To object or for more information, visit [URL].’

• Bot interrogation system. Allow meeting organizers and participants to query bots in real time: ‘What data are you capturing? Where is it stored? Who has access? Will it be used for AI training?’ And if it cannot satisfactorily answer these questions, it should be disallowed from the meeting. Most meeting platforms include a chat function that allows targeting or tagging a specific meeting participant. The Bot should accurately respond to chat messages or DMs requesting details on its capabilities.

• Clear bot identification. Use a robot icon or similar visual indicator. Require ‘Bot’ or ‘AI’ in the participant name. Make bot nature obvious at a glance.

• Default to no training. Do not use customer meeting data to train AI models unless the customer explicitly opts in. Make training opt-in, not opt-out or hidden in terms of service.

• Provide granular controls. Allow customers to configure data retention periods, disable specific features (screenshots, voiceprints), and delete data on demand.

• Comply with biometric laws. If generating voiceprints, comply with BIPA: obtain informed written consent, publish retention and deletion policies, do not sell or profit from biometric data.

AI Notetaker vendors are not likely to take these actions without significant legal or financial pressure. Companies like Otter.ai (as alleged in the consolidated complaint) that auto-join meetings, capture multi-modal data, generate voiceprints, and reserve rights to use data for model training exemplify the practices that create ECPA, CIPA, and BIPA exposure.

Best Practices for Lawyers Using AI Transcription Tools

1. All-Party Consent

• Require all-party consent for every meeting where AI transcription is used. Do not rely on ECPA’s one-party consent rule—it is inadequate when conversational data has commercial training value.

• Pre-meeting notice: Include explicit disclosure in calendar invites identifying the AI tool, what data it captures, and whether data will be used for training.

• In-meeting confirmation: Verbally confirm at meeting start that recording is occurring and provide opportunity to object.

• Document consent: Maintain records (email confirmations, chat logs, meeting recordings) showing consent was obtained.

2. Vendor Due Diligence

Vendor selection is a risk management function, not just procurement. And although this is in doubt due to the Ninth Circuit’s decision in Popa, it is possible that a vendor’s contractual right to use data is sufficient for liability under the capability test (see Part 2) These questions should inform your firm’s decision to employ a notetaker bot.

Critical Questions to Ask Vendors

Ask these questions of any vendor you’re considering. And in an abundance of caution, require written answers since policies and practices change quickly in AI-tool-land.

• Does the vendor use meeting data to train AI models? If yes, is this opt-in or mandatory?

• Where is data stored? Who can access it (vendor employees, subprocessors, affiliates)?

• Does the tool generate voiceprints or other biometric identifiers? Can this be disabled?

• Does the tool capture screenshots or video? Can this be disabled?

• What indemnity does the vendor provide for wiretap, privacy, and biometric violations?

• Can the vendor provide SOC 2, ISO 27001, or similar compliance certifications?

Red flag: Vendors unable or unwilling to answer these questions clearly should not be used for private or client communications.

Contract Terms

Your firm and clients will likely be very limited in negotiating for control of the terms of a built-in notetaker. You will likely only be able to negotiate the terms of Notetaker bot contracts in the enterprise context and with custom-built solutions. If you have an option, negotiate protective contract terms that limit vendor capability and rights. Here is what I suggest:

• Explicit prohibition on training: ‘Vendor shall not use Customer meeting data to train AI models or develop other products.’

• Data minimization: ‘Vendor shall collect only minimum necessary data. Customer may disable screenshots, voiceprints, and other optional features.’

• Retention limits: ‘Customer may configure retention periods. Vendor shall delete data upon expiration or Customer request.’

• No third-party sharing: ‘Vendor shall not share Customer data with affiliates or third parties without prior written consent.’

• Uncapped indemnity: ‘Vendor indemnifies Customer for ECPA, CIPA, and BIPA violations without liability cap.’

Operational Controls

Regardless of the notetaker, implement technical and operational safeguards:

• Disable auto-join features. Require manual bot activation to ensure conscious consent.

• Default to local recording when possible. Avoid sending data to third-party cloud servers.

• Segregate by matter sensitivity. Prohibit AI transcription entirely for the most sensitive matters (litigation, M&A, internal investigations).

• Train staff on consent requirements, how to identify bots, and incident response procedures.

• Audit usage quarterly. Review vendor access logs and compliance with firm policies.

Guidance for Lawyers Advising AI Note-Taker Vendors

Reevaluate Deidentification Claims, and Abandon Weak Claims

If your client claims they ‘only train on deidentified data,’ strongly advise reconsideration. This defense is weak and potentially counterproductive. Conversational data resists meaningful deidentification—context reveals speakers even when names are removed. From a litigation perspective, weak deidentification policies can be worse than none because they demonstrate awareness of data sensitivity combined with inadequate protection.

Better approach: Do not use customer data for training at all. If training is essential to the business model, make it genuinely opt-in with clear disclosure of what is being collected and how it will be used.

Map the Data Supply Chain

Create a detailed data map for your client’s product:

• What is captured? (audio, video, screenshots, chat, metadata, voiceprints)

• Where does it flow? (cloud provider, geographic location, subprocessors)

• How long is it retained? (per-customer configuration, automatic deletion)

• For what purposes? (transcription only vs. training vs. analytics)

The more the data map resembles a private data extraction pipeline (capturing multi-modal data, sending to centralized storage, retaining indefinitely, using for training), the easier it is for plaintiffs to frame intrusion and conversion claims.

Limit retention and reuse to what is reasonably necessary for the stated service. Put these limits in both internal policies and customer contracts.

Treat Biometrics as High-Risk

If your client’s product generates voiceprints for speaker identification, treat this as a BIPA compliance requirement, not a feature decision.

BIPA requires:

• informed written consent before collecting biometric data,

• published written retention and deletion policy,

• prohibition on selling or profiting from biometric identifiers,

• private right of action with $1,000-$5,000 statutory damages per violation.

Make voiceprint generation opt-in, not default. Provide clear disclosure of how voiceprints are generated, stored, used, and deleted. Do not use voiceprints for model training. Implement automatic deletion when customer relationship terminates.

If your client cannot comply with BIPA, disable persistent voiceprint features entirely and use session-only speaker identification.

Design for Minimal Capability

Under CIPA’s capability test, your client’s technical architecture and contract terms create liability exposure. Design the product to minimize vendor capability to access or reuse customer data:

• Process data locally on customer infrastructure when feasible (edge computing).

• Use customer-managed encryption keys so vendor cannot access data without customer cooperation.

• Segregate customer data in isolated environments—no commingling across customers.

• Default to ephemeral processing (process in memory, deliver transcript, delete audio).

• Design AI models to improve only within each customer’s environment, not across all customers.

The goal is to make unauthorized data use technically difficult, not just contractually prohibited.

One-Page Guidance

Review the following checklist to share with your firm’s clients, and compliance or risk evaluation teams or feel free to use the checklist on Lexara’s Resource page.

Quick Reference: Risk Mitigation Checklist

Use this checklist to assess and mitigate AI transcription risk.

For Every Meeting With AI Recording

☐ All participants notified before meeting (calendar invite disclosure)

☐ Verbal confirmation at meeting start, with an opportunity to object

☐ Bot clearly identified (name includes ‘Bot’ or ‘Notetaker’)

☐ Persistent visual indicator active during recording

☐ Consent documented (email, chat log, or recording itself)

☐ Participants know what happens to data (local storage only vs. cloud/training)

When Selecting an AI Transcription Vendor

☐ Vendor provides written answers to data use questions

☐ Training is opt-in or can be disabled entirely

☐ Voiceprint generation can be disabled

☐ Screenshot capture can be disabled

☐ Data retention is customer-configurable

☐ Vendor provides SOC 2 or equivalent certification

☐ Vendor offers uncapped indemnity for privacy/wiretap violations

During Vendor Contract Negotiations

☐ Explicit prohibition on using customer data for training

☐ Data minimization obligation (minimum necessary data only)

☐ No third-party sharing without prior written consent

☐ Customer can configure retention periods and request deletion

☐ Vendor must encrypt data in transit and at rest

☐ Breach notification within 24 hours

☐ Indemnity for ECPA/CIPA/BIPA violations survives contract termination

For Law Firm Operational Controls

☐ Written AI transcription policy established

☐ Matters classified by sensitivity (prohibit AI for most sensitive)

☐ Auto-join features disabled (manual activation required)

☐ Default to local recording when possible

☐ Staff trained on consent requirements and bot identification

☐ Quarterly audits of AI tool usage and vendor access logs

☐ Incident response procedures for unauthorized recordings

Red Flags - Do Not Use This Vendor If:

✗ Vendor cannot or will not answer data use questions in writing

✗ Terms of service include ‘may use data to improve services’ without opt-out

✗ Voiceprints are generated by default and cannot be disabled

✗ Data retention is indefinite with no customer control

✗ Vendor refuses to provide compliance certifications

✗ Indemnity is capped below statutory damages exposure

✗ Vendor reserves right to share data with ‘partners’ or affiliates

Conclusion

Each party in the AI transcription space—passive participants, bot users, meeting organizers, platform makers, and bot creators—has a role in reducing risk. For lawyers, the imperative is clear: implement all-party consent, conduct rigorous vendor due diligence, negotiate protective contracts, and establish operational safeguards. For those advising AI vendors, the guidance is equally direct: design products to minimize capability, abandon weak deidentification claims, and treat biometrics as high-risk regulated data.

Approach AI transcription in the mindset of the party host context – would a party guest expect this type of treatment? Using informed risk management can help your clients realize productivity benefits while minimizing legal exposure. Alternatively, clients that deploy these tools without attention to consent, vendor contracts, and operational controls may find themselves defending class actions under statutes with statutory damages that can generate crippling exposure when multiplied across thousands of recorded conversations.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Part 1 of this series explained why meeting and call recordings are unusually valuable AI training material: they are contextual, domain-rich, and outcome-linked in a way scraped web text is not. That value also creates legal exposure. When vendors design note-takers and contact-center AI to capture conversations, retain them, and reserve broad rights to reuse them for “product improvement” or model training, plaintiffs are increasingly framing the vendor as an unlawful interceptor rather than a simple, neutral productivity tool.

This article focuses on the three legal frameworks now driving AI note-taker litigation—the federal Electronic Communications Privacy Act (ECPA), California’s Invasion of Privacy Act (CIPA), and state biometric statutes led by Illinois’ Biometric Information Privacy Act (BIPA)—and then applies them to two active class actions: In re Otter.ai Privacy Litigation and Ambriz v. Google.

A consistent theme runs through these cases. Liability often turns less on whether a recording occurred (everyone agrees it did) and more on (1) what the vendor’s architecture allows, (2) what its contract permits, and (3) whether the vendor has a recognizable economic incentive to reuse the data.

It’s a double-edged sword: centralized processing, persistent speaker identification, and expansive license terms are precisely what make these systems valuable. But that’s also exactly why they are the subject of these class action lawsuits.

The Legal Framework

There are no sufficient AI and privacy laws for plaintiffs who believe their privacy was invaded during an AI meeting to use in bringing claims. And so Plaintiffs in AI note-taker cases are repurposing statutes written for telephone wiretaps and applying them to cloud-based conversational AI. Plaintiffs typically plead three overlapping theories, because each statute attacks a different part of the product stack: interception, consent/disclosure, and biometric identifiers.

Electronic Communications Privacy Act (18 U.S.C. § 2511)

The ECPA (ECPA § 2511(1)(a)) prohibits intentional interception of wire, oral, or electronic communications. For decades, those who want to record a conversation without seeking consent of the other party have relied on Section 2511(2)(d). It contains the familiar one-party consent exception, but also an interesting caveat. Interception is lawful if one party consents—unless it is done “for the purpose of committing any criminal or tortious act.”

Historically, one-party consent made recording simple; if a participant agreed, the recording was lawful. Plaintiffs are now taking advantage of the tortious-purpose carve-out. Plaintiffs argue that if they can show the interception was for a criminal or tortious purpose, the onepartyconsent defense fails under § 2511(2)(d), making the recording unlawful even if one party consented. Three torts fit well into this tortious-purpose carve-out:

• Intrusion upon seclusion: inserting a vendor into private conversations for undisclosed analytics or training, undermining reasonable privacy expectations.

• Conversion / misappropriation: treating conversational data as valuable property and appropriating it to improve proprietary systems sold to others.

• Unjust enrichment: extracting economic value from private speech without meaningful consent or compensation.

The pleading strategy is straightforward. Plaintiffs allege that the “real” purpose of the interception is not just note-taking, but building datasets that improve a vendor’s speech recognition, summarization, or LLM capabilities—thereby increasing product value and revenue. The more a vendor’s terms, marketing, and technical design suggest a pipeline from “captured conversation” to “improved model,” the easier it is to plead tortious purpose in pursuing these claims. And even though a single tortious claim won’t gain much traction, stacked together as a class action, and these cases take on a whole new meaning, especially when used with other state laws, such as the CIPA and the BIPA.

California Invasion of Privacy Act (Cal. Penal Code §§ 631–637.5)

California’s Invasion of Privacy Act (CIPA) is the most consequential statute for AI-recording tools. Although it only applies to California conversations, it is powerful. It is generally an all-party consent regime for many communications, it includes a private right of action, and it authorizes statutory damages that are pleaded at up to $5,000 per violation—an enticement that makes class actions feasible even when actual damages are hard to quantify.

Several sections are routinely invoked in AI transcription and note-taker cases:

• § 631 (anti-wiretap): interception or “reading” of communications in transit—now applied to cloud AI that processes audio/text in real time during transmission.

• § 632 (confidential communications): recording/eavesdropping on “confidential communications” without consent of all parties. “Confidential” is often construed broadly in modern cases and can include virtual meetings, professional consultations, and customer service calls where participants reasonably expect limited dissemination.

• § 632.7 (cellular/cordless calls): protects many phone calls without requiring malicious intent, frequently pleaded for smartphone calls routed through AI contact centers.

• § 637.5 (subscriber conversations at home): historically aimed at monitoring of subscriber conversations in residences; now pleaded in some contact-center contexts tied to subscriber accounts.

• § 637.2: private right of action and statutory damages.

Third-Party Eavesdropper Doctrine “Extension” vs. “Capability”

CIPA litigation often turns on whether the technology provider is a party to the communication (permitted to receive/record it) or an unlawful third-party interceptor. Recent cases have sharpened two tests in regard to whether the provider is a party or interceptor.

• Extension test: the vendor is a third party only if it actually uses the data for its own ends (training, analytics, product improvement).

• Capability test: the vendor is a third party if it could use the data for its own ends—based on architecture and contractual rights—regardless of proof of actual use.

In Ambriz v. Google, the Northern District of California adopted the capability approach at the pleading stage for § 631(a). Plaintiffs plausibly alleged that Google’s platform could use intercepted call data, supported by terms reserving rights to “improve services.” The court did not require proof that Google trained models on the plaintiffs’ specific calls.

This is why “product improvement” language matters. Under a capability theory, broad license language plus centralized cloud processing can convert an AI vendor from “service provider” to “statutory eavesdropper,” even if the vendor insists it never trains models on customer-specific content. In practice, that means not only that contract drafting can be as important as actual data practices, but also that plaintiffs can survive early motions by pointing to rights reserved in terms of service and the technical reality that the vendor sits “in the middle” of communications.

Biometric Privacy Statutes, Led by Illinois’ BIPA (740 ILCS 14/1 et seq.)

Another powerful state law is Illinois’ Biometric Information Privacy Act. BIPA regulates collection, retention, and use of biometric identifiers, including voiceprints. Its core requirements:

• informed written consent before collecting biometric identifiers;

• a publicly available retention and deletion policy; and

• restrictions on profiting from biometric identifiers.

BIPA’s private right of action and statutory damages ($1,000 for negligent violations; $5,000 for intentional or reckless violations) make class actions compelling.

In the note-taker setting, plaintiffs commonly allege that systems generate persistent voiceprints (mathematical representations used to identify a speaker across interactions). Vendors sometimes respond that they do not create “voiceprints,” that any signal is transient, or that the data is deidentified. But the counterargument is that BIPA regulates the identifier itself and that deidentification is not a complete answer when the vendor still has the capacity to recognize, re-identify, authenticate, or train on those identifiers.

Texas (Tex. Bus. & Com. Code § 503.001) and Washington (RCW 19.375) have related biometric statutes, though with different procedural and damages features. Where products include persistent voice or facial recognition—especially “speaker recognition” or “voice identity” features marketed as productivity enhancements—biometric claims are likely to remain stronger claims.

The Trifecta

These three laws converge on one vulnerability: the value of these recorded conversations. Vendors have not only contractual permission but also strong financial incentives to retain and reuse conversational data. Put differently, as conversational data becomes more valuable to AI development, plaintiffs can plausibly allege that certain “productivity tools” operate as data-extraction systems—and then use old statutes to police that business model. The trifecta is powerful because it attacks the same conduct from three angles and stacks damages theories.

Case Study: In re Otter.ai Privacy Litigation

Originally filed as Brewer v. Otter.ai, this consolidated litigation includes plaintiffs from California, Illinois, and Washington asserting wiretap, biometric, and common-law claims. The focus is Otter Notetaker, which plaintiffs describe as a system that joins meetings, captures multi-modal content, and generates identifiers that allow long-term reuse.

How Otter Notetaker Allegedly Works

The Complaint alleges that when a user connects a calendar, Otter automatically joins scheduled meetings. During a meeting, it allegedly:

• records full audio;

• captures periodic video-call screenshots;

• transcribes speech and links words to timestamps;

• collects participant identity metadata (e.g., names and emails from meeting platforms and calendars);

• ties that identity data to the transcript (“who said what and when”);

• generates and stores a voiceprint for each speaker to recognize them across future meetings; and

• streams the resulting audio, screenshots, transcripts, metadata, and voiceprints to Otter’s servers.

Two features matter legally. First, automation; a bot can “attend” meetings by default through calendar integration, reducing the friction and visibility of recording. Second, richness; the dataset is not just an audio file. Rather it is audio plus transcript plus metadata plus (alleged) biometrics, creating a structured record that is more reusable for downstream training and analytics.

What Plaintiffs Claim Was Captured

Plaintiffs allege recording and vendor retention of highly sensitive meetings: attorney-client and legal strategy discussions, medical and therapy appointments, support groups, religious meetings, and confidential corporate calls involving trade secrets and personnel issues. The claimed injury is not merely that a conversation was recorded, but that participants’ reasonable expectations were undermined by silent, automated capture and repurposing of intimate communications by a commercial AI provider they did not choose.

Plaintiffs allege that bots amplify traditional recording risk by automating attendance, capturing multiple data modalities, and purportedly creating persistent biometric profiles that can follow a person across organizations and contexts—including contexts where privilege or professional confidentiality is expected or understood.

Case Study: Ambriz v. Google

Ambriz arises from routine customer service calls allegedly processed through Google Cloud Contact Center AI. Plaintiffs claim they were not told Google was involved and did not consent to Google recording, transcribing, and analyzing their calls.

How Contact-Center AI Allegedly Operates

Plaintiffs allege the platform processes call audio in real time to provide features such as live transcription, intent/sentiment analysis, virtual agents, and smart-reply suggestions to human agents, while also storing call artifacts (audio, transcripts, and related metadata such as call duration, account identifiers, and routing data). From a functionality perspective, the vendor is not simply “hosting” a call; it is actively transforming and interpreting call content as the call unfolds.

This case is in the early stages, but notably the Northern District of California denied a motion to dismiss key CIPA claims. The court treated active, real-time processing and analysis as interception in transit for § 631(a) purposes, and it emphasized that contractual rights and technical ability to use call data for Google’s own ends (including “improving services”) were sufficient at the pleading stage to treat Google as a potential third-party interceptor—without proof of actual model training on the plaintiffs’ specific calls.

The court also rejected a categorical argument that smartphone calls fall outside CIPA because smartphones are general-purpose computers, distinguishing the phone function as telephonic communication for purposes of CIPA provisions implicated by cellular calls. And the court allowed additional claims to proceed under other CIPA provisions pleaded by plaintiffs, underscoring how creatively plaintiffs can map modern call flows onto older statutory language.

What Makes Ambriz Structurally Different

• Involuntary participation: consumers did not choose the vendor and could not realistically opt out.

• Disclosure gaps: generic “this call may be recorded” warnings may not identify the third party or explain secondary uses—especially model training or analytics.

• B2B2C risk chain: the vendor, the enterprise customer, and the consumer sit in different legal positions, creating indemnity and allocation fights.

• Scale: contact centers process massive call volumes; statutory damages theories can quickly dominate settlement posture.

A Caveat To Ambriz

Shortly after the court denied Google’s motion to dismiss in Ambriz, the Ninth Circuit entered a decision in Popa v. Microsoft Corp that complicates the capability-test approach. In Popa, the plaintiff alleged a website was tracking her actions and keystrokes. The court dismissed her claims for lack of standing, holding that she failed to identify any embarrassing information collected, which was necessary to establish an actual injury. While Popa involved website session-replay technology rather than voice recordings, its standing analysis suggests that capability-based theories may face appellate scrutiny. If appealed in Ambriz, the viability of the capability test may turn on whether voice recordings of customer service calls are categorically more sensitive than website browsing data, or whether plaintiffs must make particularized showings of actual harm.

What These Cases Mean For AI

The Otter.ai and Ambriz complaints involve different settings—enterprise meetings versus consumer customer-service calls—but the pressure point is the same. If the vendor’s system and contract allow it to extract and retain rich conversational data (audio, transcripts, metadata, screenshots, and voiceprints) and to reuse that data for model training or “service improvement,” plaintiffs can plausibly plead:

• interception beyond a simple “one party consented” model (ECPA);

• third-party eavesdropping based on capability and reserved rights (CIPA); and

• biometric collection and retention without written consent or compliant policies (BIPA and related statutes).

The terms of service and privacy policy now matter as much as the fact of recording. “We may use data to improve our services” carries far wider repercussions than that your information is being used to train an AI model. Features like speaker recognition, voiceprints, and image capture can convert an otherwise ordinary transcription tool into a biometric-privacy case.

Next Article: Part 3

Part 3 will give you concrete guidance to use for yourself and your clients. We’ll include a convenient “cheat sheet” that you can share with your clients to help them stay on top of privacy issues.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

You join a Zoom call to discuss settlement strategy. Three colleagues from your law firm’s offices in different cities appear on screen. But there’s a fourth participant—one that you weren’t aware was invited. In fact, it may not even be visible: an AI notetaker bot. The AI note-taking bot records the audio, transcribes every word, captures screenshots of the video, extracts participant names and emails from the calendar invite, and perhaps even generates a persistent voiceprint for each speaker.

Even if a colleague asks if you mind them recording the meeting as a notetaker, you might not give much thought to this, since the meeting is only among lawyers at the same firm.

But what happens to the data that the AI notetaker bot gathers and what it does with that data should give you pause. Unfortunately, your data most likely does not sit quietly in a dark electronic file. Rather, all of your data flows to the vendor’s servers, where it may be used to train the company’s proprietary AI models.

AI Notetaker Bots Are Now the Norm

The scenario is far from hypothetical. During Covid, we gained a level of comfort with virtual meetings. For better or worse, professionals in the same city now regularly take meetings virtually where several years ago we would have driven 15, 20 or even 30 minutes to meet in person. Microsoft Teams, Google Meet, and Zoom have made AI transcription a default feature, not an add-on. Otter.ai boasts that it has transcribed over one billion meetings.

I will usually gamble on getting the service I am hoping for by engaging the online chatbot that continually pops up in the lower, right-hand corner, reminding us of its willingness to assist. These days such chatbots are generally equipped with a warning “this conversation may be recorded to improve our blah blah blah.” Boring, right? I’m a lawyer and AI expert, and I barely glance at those warnings. And the warnings on the telephonic bots are equally as bland and non-descriptive, especially in light of what the system capturing this data is doing with it.

AI-powered transcription has become workplace infrastructure. A 2025 survey found that 22% of legal professionals use AI transcription tools for client meetings, depositions, and internal strategy sessions. Adoption rates are higher in large law firms (approaching 40%) and continue to climb as vendors integrate transcription features directly into video conferencing platforms. What started as a pandemic-era convenience has become embedded in professional workflows.

The contact-center industry has adopted AI transcription at even greater scale. Google Cloud Contact Center AI, Amazon Connect, and similar platforms process millions of daily customer service calls through systems that transcribe conversations in real time, analyze sentiment and intent, generate suggested responses for human agents, and store call data for quality assurance and analytics. For enterprises handling customer service at scale—telecom providers, retailers, financial services, healthcare—AI transcription is no longer optional infrastructure.

Why We Should Pay Attention to the Bot Disclaimers

Many users, including lawyers, do not fully understand the data flows these tools create. A meeting transcript is not merely a text file saved locally. Depending on the vendor’s architecture and terms of service, it may include audio files, video screenshots, participant metadata pulled from integrated calendars and contact lists, persistent speaker identification across multiple meetings, and contractual permissions allowing the vendor to use all of this material to “improve services” or train AI models. The gap between user expectations (“I’m just recording this meeting for my notes”) and vendor capabilities (“we reserve the right to use your data for product development”) is where litigation risk emerges.

Recent class actions signal that this risk is materializing. In re Otter.ai Privacy Litigation challenges Otter’s AI meeting assistant under federal wiretap law, California and Washington state privacy statutes, and Illinois’ biometric privacy law. Ambriz v. Google targets Google’s contact-center AI platform, arguing that Google intercepts customer service calls as an undisclosed third party. Both cases share a common theory: AI vendors that record private conversations and use the resulting data to train commercial models are statutory eavesdroppers, not neutral productivity tools.

Here’s why conversational data matters for AI training.

If Data is Fuel for LLMs, Conversations are High-Powered Rocket Fuel

Most public AI litigation still focuses on models trained on scraped web data—authors and creators objecting to their published work being appropriated for training datasets in cases like Kadrey v. Meta and Bartz v. Anthropic. While those cases remain important, AI note-taker litigation highlights a different and potentially more valuable data source: live, high-signal conversational data from meetings and customer service calls.

Conversational data has characteristics that make it uniquely valuable for training AI models, particularly for conversational agents, summarization tools, and task-oriented reasoning systems.

Live Conversations Are Scarce and Highly Structured

Real-time recordings and transcripts of meetings and calls capture detailed, candid information about problems, decisions, and strategies in ways that scraped web text cannot. Customer service calls, internal strategy meetings, legal consultations, therapy sessions, and technical support interactions are not random collections of words. They are contextual and labeled. Who is speaking, what problem they are describing, and how it gets resolved are often explicit in the conversation. These conversations are domain-rich, reflecting actual workflows in finance, healthcare, law, HR, and technical support.

In contact-center environments, they are outcome-linked, tied to CRM records showing whether the issue was resolved and whether the customer was satisfied.

For an AI vendor, this is extraordinarily valuable training material. Compared to generic scraped text, conversational streams improve intent recognition, summarization accuracy, and task-oriented reasoning in exactly the domains enterprise buyers care about. If scraped web data is like reading every published case and law review article, live conversational data is like recording every confidential client consultation, jury deliberation, and settlement conference.

Virtual Meetings Create Multi-Modal Training Datasets

The consolidated complaint in Otter.ai illustrates how a simple “note-taker” can extract multiple data layers from a single meeting. Plaintiffs allege that Otter Notetaker transcribes the full conversation and ties words to timestamps, captures screenshots of the video call, pulls identity metadata such as names, emails, and contact details from Zoom, Teams, Google Calendar, and Outlook, and generates and stores a persistent voiceprint for each speaker, allegedly recognizing those speakers across future meetings.

Legally, this transforms a single meeting into a bundle of:

• content (what was said),

• context (who said it, when, and with whom),

• imagery (who was on screen), and even

• biometrics (voiceprints used for speaker identification).

For AI vendors, this multi-modal dataset—audio, transcripts, screenshots, metadata, and biometric voiceprints—is far more valuable than scraped web text for training conversational AI models. It allows vendors to improve speech recognition, speaker diarization (determining who said what), sentiment analysis, and contextual understanding by learning from real professional conversations.

From a privacy and liability perspective, however, this looks less like the transcript of a random meeting and more like systematic extraction of private communicative and biometric data without meaningful consent or disclosure.

Otter.ai Recognizes The Value of Conversations

The economic value vendors place on conversational data is evident in how they market these tools. One of Otter.ai’s founders, Sam Liang, has recently published a post confirming this strategic value. For example, in a LinkedIn post celebrating the company’s growth, he described meeting transcripts as “the dominant system of record” for enterprises, describing conversations as capturing “truth” and decisions before they become formalized documentation. While this marketing describes value delivered to customers (helping companies organize their own meetings), it underscores why conversational data is attractive for AI training. Specifically, meetings contain authentic, contextual, outcome-linked information that static documents lack. The same characteristics that make meeting data valuable for customer knowledge management make it valuable for training conversational AI models.

Conversational Data vs. Web Scraping

Public debates around AI often center on whether scraping websites constitutes copyright infringement or fair use. I’ve studied scraped data litigation in depth. This conversation data capture operates in an entirely different legal framework. Training on private conversations is categorically more invasive than web scraping—it converts private speech into reusable training assets without meaningful consent or transparency.

The following table illustrates the legal and practical differences:

This comparison reveals why conversational data creates legal exposure that web scraping does not. The underlying conversations were never intended to be public. They can involve professional confidences, medical information, or business strategy. The data collection implicates wiretap law, biometric statutes, and privacy torts—not just copyright. And reidentification is easy. Even with names removed, distinctive context (a company’s specific problem, a customer’s account details, a lawyer’s legal strategy) often reveals who was speaking.

Otter.ai Acknowledges Training Its Models on Recorded and Transcribed Meetings

Otter.ai publicly acknowledges using customer meeting data to train its AI models, making the legal vulnerability discussed in this series concrete rather than theoretical.

According to Otter’s Privacy & Security page, “Otter uses a proprietary method to de-identify user data before training our models so that an individual user cannot be identified.” The company’s Terms of Service specify that while customers retain ownership of “User Content,” they grant Otter a broad “worldwide, non-exclusive, royalty-free license to host, store, modify, process, and distribute that content as needed to provide the service and related functionality.”

Otter’s Privacy Policy states that personal information may be processed for purposes indicated in the policy or as otherwise notified to users, and that Otter may transfer personal data to third parties consistent with those purposes.

External analyses confirm that Otter obtains this permission through account settings where users check a box allowing Otter to access private conversations for training and product improvement. Critically, this consent mechanism operates at the account-holder level—the person who brings the Otter bot to a meeting—not necessarily from all meeting participants.

Here’s what makes Otter.ai’s practices so dodgy. A meeting participant might not even realize that they are being recorded by Otter.ai. That their image, voiceprint, and statements might be used by Otter in various ways. Otter’s ToS state, “You acknowledge and agree that you are solely responsible for providing any notices to, and obtaining consent from, individuals in connection with any recordings as required under applicable law.” In this way Otter.ai is attempting to transfer responsibility and likely liability to the person or entity using Otter.ai as their notetaker.

And that situation of not even being aware of the recording or transcription plays into Plaintiffs’ complaints in the consolidated litigation. When an Otter user enables training and joins a meeting with non-consenting participants, Otter’s contractual right to use that meeting data for model training purportedly converts Otter from a neutral transcription service into a third-party interceptor extracting valuable data without all-party consent.

The “Deidentification Defense” Fails

Some AI vendors, Otter.ai among them, claim they only train on deidentified data, suggesting this mitigates privacy concerns. In the conversational AI context, this defense is less effective than it appears and may actually increase litigation risk by demonstrating that the vendor recognized the data’s sensitivity but failed to adequately protect it.

Conversational records are unusually resistant to effective deidentification. Even when direct identifiers like names are removed, context often reidentifies speakers or organizations. A customer service call about a billing dispute for a specific account, a legal consultation about a pending acquisition, or a therapy session discussing a particular diagnosis all contain enough detail that removal of the speaker’s name does not render the conversation anonymous. When datasets also include audio files, video screenshots, or voiceprints, the concept of deidentification becomes meaningless—the voice itself is a biometric identifier.

Deidentification Isn’t Really Deidentification

Otter.ai’s privacy policy gives a false sense of security in regard to the use of the information gathered by Otter.ai in these meetings. You see, deidentification isn’t really deidentification. As discussed above, conversational data resists meaningful deidentification because context reveals speaker identity even when names are stripped. Moreover, Otter.ai acknowledges that once meeting data enters the training pipeline, as a practical matter it is not removable from already-trained models even if you later delete the source data. From a litigation perspective, this admission is significant; it confirms that Otter’s use of meeting data is not temporary or ephemeral but results in permanent incorporation into Otter’s commercial AI products. This supports the Otter.ai Plaintiffs’ conversion claims such as permanent appropriation of valuable personal property.

The combination of admitted training practices, broad license terms, and account-holder-only consent creates exactly the exposure that seems as though it should be actionable. Plaintiffs are using older laws such as the Electronic Communications Privacy Act (ECPA) to various state privacy laws in order to pursue claims, as discussed in depth in Part 2 of this series.

Otter’s Software Services Agreement for enterprise customers may provide additional protections, but the core tension remains: when AI vendors reserve contractual rights to use meeting data for their own model training, they transform themselves from service providers into data extractors—precisely the characteristics that can transform meeting transcription tools into electronic eavesdroppers.

Meeting Transcription, or Electronic Eavesdropper?

This lack of ability to de-identify plays directly into plaintiffs’ legal theories. When a vendor has economic incentive to retain and reuse conversational records (to train models that will be sold to other customers), plaintiffs argue the recording was not incidental to providing the requested service. Instead, it was appropriation of something with real market value. The same commercial incentive supports plaintiffs’ “tortious purpose” arguments under federal wiretap law: the interception was undertaken not merely to provide meeting notes or call transcripts, but to extract private communications and biometrics for the vendor’s own enrichment.

The cycle is self-reinforcing. The more valuable conversational data becomes for training large language models, the more plaintiffs can argue that AI vendors operate data extraction businesses disguised as productivity tools. That characterization in turn supports claims of intrusion upon seclusion, conversion, unjust enrichment, and violations of the “tortious purpose” exception to one-party consent under the Electronic Communications Privacy Act.

We are so used to seeing AI notetaker bots that many of us are not concerned by whether one or more are in attendance. But in ignoring the attendance of these tools has potential repercussions that we are not aware of.

AI transcription tools are undoubtedly useful. But consumers and unwitting, uninformed meeting participant should be made aware of what is likely happening to their data when AI notetakers in general--and Otter.ai in particular--are attending the same meeting they are.

Next Article . . .

Statutory and Case Law Defining the Rights of Parties Part 2

Recent class actions challenge AI note-taker and contact-center tools under three primary legal frameworks, each of which will be examined in detail in Part 2 of this series.

1. Federal wiretap law (the Electronic Communications Privacy Act) repurposed into a tool used with AI recordings and transmissions;

2. California’s Invasion of Privacy Act (CIPA), which requires all-party consent for recording many communications and provides a private right of action with statutory damages of up to $5,000 per violation; and

3. State biometric privacy laws, led by Illinois’ Biometric Information Privacy Act (BIPA), which regulate the collection and storage of biometric identifiers including voiceprints.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.

Image by Joyce N. Boghosian, used pursuant to  17 U.S.C. §§ 105, 106 (2020)

Executive Summary

President Trump’s December 11, 2025 AI Executive Order seeks national uniformity in AI regulation to keep the United States innovative and dominant in AI. He explicitly links this dominance to economic and national security. And so he took aim at divergent state laws, seeking to corral them with threats of court challenges, and denial of federal funding. But will it clear the way for innovation, as he hopes? Or will it lead instead to greater instability? The AI Executive Order is likely to prolong uncertainty for AI businesses, undermining innovation rather than delivering the uniform national AI framework hoped for.

On December 11, 2025 President Donald Trump signed his AI Executive Order “Ensuring a National Policy Framework for Artificial Intelligence.”

That day I posted the top 5 things lawyers needed to know about the new AI EO. I thought I would leave it at that, but find I can’t. While not wanting to make this newsletter overly political, I do want to include important information on AI in law for legal professionals, which, in this case, involves politics. Trump’s most recent AI executive order is an unfortunate use of executive power because it seeks nationwide uniformity not through Congress and durable legislation, but through an executive-branch strategy of federal pressure and litigation against states that have adopted differing rules. Whatever one’s preferred end state for AI innovation and governance, this approach predictably intensifies state–federal conflict and invites years of uncertainty about which rules apply, when, and to whom—exactly the environment that undermines responsible stable compliance for the public and for businesses building or deploying AI. Rather than paving the way for innovation, it has a chilling effect on AI innovation.

Two Ways to Achieve Uniformity

President Trump’s stated objective in this Executive Order is to achieve regulatory uniformity in regard to AI. There are at least two ways to do that. Ok, there are a large number of ways to achieve uniformity – far more than two. But I’m referring to two that are somewhat synonymous.

There is a meaningful difference between national uniformity achieved through legislation and “national uniformity” pursued through an executive directive aimed at challenging state policymaking. The minimum drinking age offers a useful comparison because it shows how the federal government has historically responded to a state-by-state patchwork using tools that are at least structurally transparent and democratically accountable—namely, a statute and a clear incentive mechanism—rather than a broad, litigation-forward campaign to deter state experimentation. That contrast helps clarify what is unusual (and potentially risky) about the AI executive order’s approach.

First Approach – Congress Passes a Law

In 1988, Wyoming became the last state to finally agree to raise the age that one could legally purchase and consume alcohol. Before that time, states had legal drinking ages as low as 18 years old. Congress and state officials argued varying ages created predictable cross-border spillovers—young people could legally drink in a nearby lower-age state and then drive home, increasing the risk of accidents on the highways. Rather than “preempt” state alcohol laws outright, Congress enacted the National Minimum Drinking Age Act (23 U.S.C. § 158) July 17, 1984, using a ‘federalism compromise.’ It conditioned certain federal highway funds on states making it unlawful for people under 21 to purchase or publicly possess alcohol (with a phased funding penalty—5% initially, 10% thereafter—for noncompliance).

This resulted in a relatively transparent, democratically accountable route to national uniformity. Congress legislated, spelling out the conditions. They tied it to a federal spending program. And with the courts as the final arbiter, the approach was tested and upheld in South Dakota v. Dole, 483 U.S. 203 (1987).

Second Approach – Executive Order Issued by One Man

Trump’s AI Executive Order pursues uniformity primarily through executive-branch litigation, and funding pressure, which can generate broad uncertainty and collateral consequences while the courts and agencies sort out the limits of executive authority.

The Executive Order of December 11, 2025 was expressly signed to accomplish three purposes:

1. Stop states from overly restraining AI innovation.

2. Allow the U.S. to maintain AI dominance, as an economic and national security imperative.

3. Root out state AI laws that allegedly require compelled speech and “truth-altering” outputs.

Let’s use the drinking age law to compare and contrast with the AI Executive Order of December 11.

The problem in both cases was a patchwork of state laws. The goal in both cases was national uniformity. The enforcement mechanism is whether the parallels end. In the Drinking Age solution, the goal was clear and agreed upon by Congress. The enforcement was likewise clear: states could maintain a lower drinking age (as Wyoming did in order to gain an economic boost from a greater section of the population being able to legally purchase alcohol), but in so doing would face clear consequences. States knew how much federal funding they would lose if they refused to raise drinking age limits.

The AI Order, on the other hand, is much more mysterious and convoluted. No one is entirely certain what the consequences of refusing to modify or revoke laws. As I used to tell my clients, litigation is wildly unpredictable. Strong cases can lose, and weak cases can win—because outcomes often turn on uncertain factors like which judge you draw and how they interpret the law. You can reduce risk, but you can’t control the outcome.

For these reasons, the AI Order is likely to create more confusion, uncertainty, and waiting in limbo to find out how things eventually shake out. And although the AI Order says the President needs to work with Congress to achieve regulatory uniformity, that mention is the only thing about this Order that involves Congress.

This Is Not a Novel Approach

Trump is hardly the first president to use an executive order to get what he could not or did not want to wait for in Congress. Many a president have used their executive power to accomplish their various goals.

In Youngstown Sheet & Tube Co. v. Sawyer (1952), the Supreme Court held that President Truman’s executive order directing the federal government to seize and operate steel mills during the Korean War was unlawful because the President may not take such domestic action unless it is grounded in the Constitution or authorized by Congress; the Court rejected the idea that “inherent” executive power could substitute for statutory authority in that context. Justice Jackson’s concurrence (the enduring takeaway) frames presidential power on a spectrum: it is strongest when acting with Congress, uncertain when Congress is silent, and at its “lowest ebb” when the President acts contrary to Congress’s expressed or implied will.

That framework is a useful lens for the December 11, 2025 AI Executive Order, which directs the Department Of Justice to create an “AI Litigation Task Force” to challenge state AI laws as unlawful (including as unconstitutional regulation of interstate commerce or “preempted” by federal law), and also contemplates identifying state laws for potential federal grant-funding consequences.

The key contrast is that Truman’s order directly displaced private control of property immediately, whereas Trump’s order primarily reorients federal enforcement and litigation posture (and leverages funding), leaving actual invalidation of state laws to courts—but Youngstown still matters because any claimed “override” of state law generally must rest on valid federal authority (statute/authorized regulation, or a clear constitutional power), not executive preference alone.

This most recent AI executive order is an unfortunate use of executive power because it seeks nationwide uniformity not through Congress and durable legislation, but through an executive-branch strategy of federal pressure and litigation against states that have adopted differing rules. Whatever one’s preferred end state for AI governance, this approach predictably intensifies state–federal conflict and invites years of uncertainty about which rules apply, when, and to whom—exactly the environment that undermines responsible regulation and stable compliance for the public and for businesses building or deploying AI.

Is The December 11 Executive Order Federal Preemption?

Section 7 of the AI Executive Order is titled “Preemption of State Laws Mandating Deceptive Conduct in AI Models.” Which leads to the question, is this really preemption, in the ‘term of art’ sense of the word?

Federal preemption is found in the Supremacy Clause, Article VI, Clause 2, of the U.S. Constitution. Simply stated it’s the doctrine that valid federal law can displace conflicting state law—most commonly through (1) an Act of Congress that expressly preempts state regulation, or (2) conflict/field preemption where a state rule cannot coexist with federal requirements. Preemption can also come from federal regulations when an agency is acting within delegated statutory authority—the Supreme Court has been explicit that federal regulations can have “no less pre-emptive effect than federal statutes.” Fidelity Federal Savings and Loan Ass’n, et al v. Cuesta, 458 U.S. 141 (1982)

An executive order, by contrast, typically binds federal agencies, not the states. It can pressure states by directing federal agencies, setting federal priorities, and conditioning federal funding on compliance. It usually does not “wipe out” state statutes on its own.

What Federal Preemption Looks Like

As a very surface-level reminder from 1L Con Law, federal preemption can be either express or implied. Express, when the language of the law states the superiority of the federal law. Implied, when the effect of the law results in a conflict between the federal and state laws, and the federal law wins out.

An example of Express Preemption:

• Airline Deregulation Act (1978) — Congress expressly barred states from enforcing laws “related to a price, route, or service” of air carriers (49 U.S.C. § 41713).
  

• CAN-SPAM Act (2003) — Congress created a national baseline for commercial email and expressly preempted many state commercial email statutes (with an exception for state fraud/deception laws in 15 U.S.C. § 7707) (15 U.S.C. Chap. 103)

An example of Implied Preemption:

• Hines v. Davidowitz (1941) — The Supreme Court held that Pennsylvania’s alien-registration law was preempted because it conflicted with, and stood as an obstacle to, the federal alien-registration system (an example of implied conflict/obstacle preemption).

What “States Yield” Looks Like (Enforcement, Not Preemption)

Executive orders allow the president of the United States to act alone, contrary to what we are taught in school as the system of “checks and balances.” Executive orders have been used numerous times, by numerous presidents. They have been used to create federal parks, resolve labor disputes, and at times, even to force states into a position of yielding to presidential will. President F.D. Roosevelt issued by far the most, although in fairness he served during WWII, and spent the longest time in office of any U.S. President.

A few notable examples:

• Eisenhower — Executive Order 10730 (Sept. 24, 1957): authorized the Secretary of Defense to take steps to enforce federal court orders in Arkansas regarding Little Rock school desegregation and to remove “obstruction of justice,” including use of federal forces—functionally overriding Arkansas’s resistance to integration.

• Kennedy — Executive Order 11053 (Sept. 30, 1962): directed Department of Defense to enforce federal court orders and remove “obstructions of justice” in Mississippi relating to the University of Mississippi integration crisis, authorizing use of federalized Guard/armed forces. See also American Presidency Project.

• Kennedy — Executive Order 11111 (June 11, 1963): authorized federalization of the Alabama National Guard to enforce desegregation orders during the “Stand in the Schoolhouse Door” at the University of Alabama. See also American Presidency Project.

In limited foreign-affairs contexts, the Supreme Court has found state laws displaced where they conflict with the federal government’s foreign policy implemented through executive action were legal (e.g., American Ins. Ass’n v. Garamendi).

The AI EO expressly directs the Department of Justice to form an AI Litigation Task Force to challenge state AI laws—including arguing they regulate interstate commerce, are preempted by existing federal regulations, or are otherwise unlawful. But this is surely a misnomer because the plain language of the December 11 AI order does not purport to override US state laws. Rather, it sets out a task force to litigate state AI laws, and perhaps deny broadband funding. It is therefore best described as a litigation-and-leverage strategy (challenge state laws; argue conflict; use federal funding), rather than preemption in the classic “Congress has spoken” sense.

Will A Litigation-and-Leverage Strategy Accomplish Trump’s Goals?

Trump’s express goal is to free-up AI companies to innovate, unfettered by a patchwork of state laws, thus keeping the US dominate in AI power. Rather than wade through the complications and delay of urging Congress to pass a uniform law, he’s chosen a route that he must believe will fast track his objective. But his litigation-and-leverage strategy can backfire in at least two ways.

First, it can chill legitimate state protections—including transparency, consumer protection, anti-discrimination, and competition-focused measures—because states and regulated entities may pause, narrow, or abandon rules in anticipation of federal challenge. That creates a practical “regulatory freeze” precisely where states are acting as first responders to emerging harms, even while Congress has not yet enacted a comprehensive national framework.

Second, the strategy can increase—not decrease—regulatory uncertainty. When the executive branch signals that a wide range of state AI laws are targets, the result is often a prolonged period of piecemeal injunctions, inconsistent court rulings, and shifting enforcement priorities. Businesses face unstable compliance obligations; consumers face uneven protection; and policymakers are pushed into a waiting game. In other words, an order designed to avoid a “patchwork” can unintentionally produce a different—and often worse—patchwork: one driven by litigation outcomes and administrative discretion rather than clear, predictable rules.

For example, consider Illinois’s Artificial Intelligence Video Interview Act (820 ILCS 42), which has been in effect since January 1, 2020. It requires employers using AI to analyze recorded video interviews for Illinois-based positions to (1) notify applicants that AI may be used, (2) provide information explaining how the AI works and the general characteristics it considers, (3) obtain the applicant’s consent before using AI, and (4) limit sharing of interview videos and delete them upon request. It also includes a demographic reporting requirement in certain circumstances, requiring employers that rely solely on AI analysis to determine who gets an in-person interview to collect and report specified race/ethnicity data.

Now layer on this AI Executive Order, which directs the DOJ to form an “AI Litigation Task Force” whose “sole responsibility” is to challenge state AI laws the Administration deems inconsistent with federal policy, including on grounds they are unconstitutional, preempted, or otherwise unlawful, and it directs Commerce to identify state laws that may compel disclosures/reporting in potentially unconstitutional ways. Regardless of who ultimately prevails, the practical consequence for multi-state employers is immediate uncertainty. Should they invest in (or maintain) Illinois-specific disclosures, consent workflows, vendor contracts, retention/deletion processes, and demographic reporting pipelines? Or would they be better off to pause or scale back in anticipation of litigation, injunctions, or shifting federal enforcement priorities?

The fallout in terms of state-based funds that will need to go to defending litigation, and the federal funds that will go into bringing these suits is disheartening, to say the least. How many other, more productive, beneficial uses could this soon-to-be-vast amount of money be put toward? Here are a few off the top of my head: housing those in need, food for people who have food insecurity, retraining for people who are likely to be displaced by AI advancements, and educational excellence.

In other words, the result is not the end of a patchwork, but a new patchwork—one defined by court orders, agency positions, and compliance whiplash rather than stable, predictable rules.

Perhaps AI companies will consider the December 11 AI EO to be carte blanche for them to innovate in any way they see fit. That raises other problems. For example, Trump is in his second term. When the next president takes office, there is a good possibility that this AI EO will be reversed, much like Trump did to Biden’s two (2) AI EOs. Companies are aware of this and may take a more cautious approach than they otherwise would have, knowing this policy likely won’t last forever. The bottom line is more uncertainty.

The December 11, 2025 AI EO Won’t Bring The Uniformity It Hopes For

In the end, the strongest critique of this Executive Order is not that it prefers national uniformity over state experimentation—reasonable people can disagree on that policy choice. Personally I have been calling for a federal AI law for many months.

My concern here is the means. A “litigation-and-leverage” approach is a blunt instrument for a domain as broad and fast-moving as AI, and it risks substituting executive discretion for the deliberative, durable rulemaking that Congress is designed to produce. Instead of resolving the very “patchwork” it decries, the Order may create a worse one, as we wait for the injunctions, legal decisions, agency interpretations, and compliance reversals that leaves businesses guessing, consumers unevenly protected, and state policymakers stalled in a waiting game.

If the goal is a coherent national AI framework, the better path is the initially more difficult one. Congress should debate and enact an AI framework, agencies should implement it through transparent processes within clear statutory bounds, and courts should remain the backstop—not the primary engine—of AI governance.

© 2025 Amy Swaner. All Rights Reserved. May use with attribution and link to article.