9
The partner proofreading a motion through a free AI assistant doesn’t think about discovery. The associate running a conflict check through a public chatbot doesn’t either. Almost nobody who uses AI in a firm thinks about the moment a subpoena arrives and the other side asks for everything you typed, every system you queried, and what it returned.
That moment is coming. And most firms are not ready for it because they’ve never been told what counts as a record in an AI workflow.
Prompts are now evidence
Courts and eDiscovery practice are converging on a simple, uncomfortable principle: a prompt is not a throwaway keystroke. It is a communication with a system that produced work product, and it carries intent. What you asked, how you asked it, what you fed it, and what you relied upon are all fair game in the very disputes where privilege matters most.
When a firm sends a disengaged client’s confidential draft through a public assistant, it is creating an evidentiary trail it does not control. The prompt history lives on someone else’s servers, under terms the firm never negotiated, subject to data policies the firm can’t see. In a discovery dispute, “we deleted it” is not an answer. “It’s on a third party’s platform” is worse.
Chain of custody becomes the battleground
The hard question in litigation is no longer just what the AI said. It is whether the firm can prove what it did with that output, who saw it, and whether the source can be verified. Screenshots don’t carry chain of custody. Imported text boxes don’t carry a defensible audit trail.
Spoliation sanctions add an edge. If a firm’s public-AI prompts are held by a vendor with a 30-day deletion window, the trail can evaporate before preservation is ever triggered. A court asked to explain that finds a firm that lost evidence it never realized it held. The duty to preserve attaches to the data the firm controls — and a prompt trail living on a third party it never negotiated with is a preservation gap a motivated opponent will exploit.
That is the gap a sovereign deployment closes. When the model runs inside the firm’s own walls, the interaction is not someone else’s record. It is the firm’s record, under the firm’s control, held to the firm’s retention and spoliation duties — the same way every other piece of internal evidence already is. There is no third-party platform to subpoena, no foreign data policy to explain to a judge, no prompt trail that wandered off the firm’s own network.
What defensible looks like
A defensible AI posture answers four questions before a subpoena ever arrives:
Where did the data go? If the answer isn’t “our own infrastructure,” you already have exposure.
What did we ask? Prompts logged on your own systems, not lost in someone else’s.
What did we keep? Retention policies that treat AI output like evidence, not noise.
Who saw it? Access controls and an audit trail that hold up under scrutiny.
The teams that answer these questions on a private deployment don’t stumble into discovery the way public-prompt firms do. They hand over a controlled, complete, defensible record — or they don’t have to explain a trail at all.
Your people are already prompting an AI system. The only real question is whether that trail belongs to you or to a platform that owes you nothing when it counts.
See exactly what your firm is exposing right now — before opposing counsel does it for you. Take the Confidential AI Exposure Checklist. Five minutes. Zero risk.