How to Stop Discovery Files From Being Uploaded to Public AI

Why is uploading discovery to public AI a problem?

Discovery material usually comes with a protective order that limits who may see it and how it may be used. A public AI account is an outside service the order does not list, so uploading produced documents can put the firm out of compliance with the order as well as its confidentiality duties. AI in eDiscovery is workable only inside a tool that fits the order's terms.

A model stipulated protective order posted by the U.S. District Court for the Central District of California shows the typical structure. Section 7.1 allows a receiving party to use protected material "only for prosecuting, defending, or attempting to settle this Action" and requires that it be stored "at a location and in a manner sufficiently secure." Section 7.2 limits disclosure of confidential material to listed categories, including outside counsel and their staff, certain party employees, the court, and experts and professional vendors who sign an acknowledgment. Section 13 requires return or destruction within 60 days of a written request after the case ends, with a written certification.

A consumer AI service that keeps prompts and uploads under its own retention terms fits poorly with each of those provisions. A firm cannot certify destruction of copies it does not control.

What do California's confidentiality rules add?

They protect the client's information in the file, whoever produced it. Business and Professions Code section 6068(e)(1) requires a California lawyer to maintain inviolate the confidence and preserve the secrets of the client. The State Bar's practical guidance on generative AI says a lawyer must not input confidential client information into a generative AI solution that lacks adequate confidentiality and security protections, and should review the tool's terms of use to see how it uses inputs.

SB 574, signed September 30, 2026 and operative January 1, 2027, adds Business and Professions Code section 6068.1. Among other provisions, it bars entering confidential, personally identifying or other nonpublic information into a generative AI system unless access is restricted to the attorney and people the attorney authorizes who are obligated to keep it confidential. The statute's definition of personal identifying information includes dates of birth, Social Security numbers, financial information, account numbers, medical information and the addresses and phone numbers of parties and witnesses. Discovery productions are full of that kind of information.

ABA Formal Opinion 512, persuasive rather than binding in California, reaches a similar point: self-learning AI tools raise the risk of improper disclosure, informed client consent is required before entering information relating to the representation into such a tool, and managerial lawyers should set clear firm policies and train lawyers and staff. California rules 5.1 and 5.3 place supervisory duties on lawyers with managerial authority over attorneys and nonlawyer staff.

Does HIPAA apply to medical records produced in discovery?

Yes, for the covered entity that produces them, and it often shapes the protective order the firm must follow. When a covered entity produces protected health information in response to a subpoena or discovery request that is not accompanied by a court order, 45 CFR 164.512(e) generally requires satisfactory assurance of notice to the individual or a qualified protective order. A qualified protective order must prohibit use or disclosure of the information for any purpose other than the litigation and require return or destruction of the PHI, including all copies made, at the end of the case.

Personal injury, employment and insurance coverage matters regularly involve these orders. Uploading medical records to a public AI tool creates a copy the firm cannot return or destroy.

Who in a law firm is likely to upload discovery files?

Anyone working against a deadline with a large production. The most common situations:

• A paralegal summarizing deposition transcripts or building a chronology.
• An associate pasting a production set into a free chatbot for AI document review.
• A legal assistant running OCR on scanned exhibits or translating foreign-language documents.
• An attorney working from a personal laptop or phone over a weekend.

None of these involve bad intent. Each involves a free or personal AI account that seemed faster than the firm's tools.

How do you use AI in eDiscovery without exposing discovery files?

Use AI in eDiscovery only inside one approved tool, and put technical blocks on everything else. A written policy depends on memory during a deadline, and technical controls keep working when people are tired.

• Approve a tool that fits the order. Choose an AI tool or e-discovery platform feature under a business agreement that restricts access to the firm, does not train on firm data and lets you delete matter data. Check it against the vendor provisions in your standard protective order, and have the vendor sign any required acknowledgment.
• Label discovery at intake. Store productions in a dedicated matter location and apply a sensitivity label such as "Protected: Discovery" when files arrive. Labels give data loss prevention (DLP) rules something to match.
• Block uploads with DLP. Microsoft Purview can apply an inline DLP policy in Edge for Business that blocks text sent to, and files uploaded to, unmanaged AI apps on Intune-managed Windows devices. Pair it with endpoint DLP rules that restrict uploads of labeled files to unapproved cloud sites.
• Filter AI sites. Block unapproved AI sites at the DNS or web filter level, which the CIS Controls list as Safeguards 9.2 and 9.3.
• Control personal devices. Require app protection policies or browser-only access for anyone opening matter files on a personal device, so files cannot be saved locally and uploaded elsewhere.
• Review attempts. Look at DLP alerts weekly. A blocked upload is a training moment, and a pattern of attempts shows where the approved tool falls short of what staff need. Note that Purview DLP policies can start in simulation mode, so confirm the policy is set to enforce.

Our article on blocking privileged documents from AI tools walks through similar Purview rules for privileged material.

What if a file was already uploaded?

Act quickly and document what happened. Identify the tool, the account, the files and the time. Review the protective order's provisions on unauthorized disclosure and the vendor's deletion and retention terms, since deleting a chat may leave copies the vendor keeps. Our guide to responding when privileged material ends up in a public AI tool covers the response steps. Notice obligations depend on the order and the matter, so involve ethics counsel early.

What should a firm do this quarter?

• Find out which AI tools attorneys and staff already use, including accounts created with firm email.
• Choose the approved tool for discovery work and check its terms against your standard protective order.
• Write a discovery intake procedure that includes labeling.
• Turn on DLP blocking for labeled files and filtering for unapproved AI sites.
• Add a section on AI and protective orders to the firm AI policy, and train every paralegal and assistant on it.
• Prepare for SB 574 by documenting who can access each approved AI system.

How can s90 help?

s90 configures the labels, DLP rules and AI site filtering that keep productions inside approved tools, and provides the alert reports that show supervision. If you want a review of how discovery files move through your firm today, we are glad to walk through it with you.