A discovery request lands on the IT director’s desk asking for all communications related to a specific vendor account. Email is easy to collect. Teams is easy. The Copilot chat logs are a JSON export from an admin console that nobody on the e-discovery team has ever ingested. The enterprise e-discovery platform spent twenty years learning how to read an email thread. It does not know how to read a context window.
The records manager pulls up the retention schedule. There is a row for email, a row for instant messaging, and a row for shared drives. There is no row for a conversation with a model that produced a contract clause.
Retention schedules were built around media. They assume a document is a discrete thing with a defined type. An AI conversation is not a document. It is a transcript of a document being made, complete with false starts, abandoned angles, and a question about the weather in Chicago in the middle of a financial forecast.
A single thread can contain a transitory message and a substantive business record. The schedule wants to classify the thread. The thread refuses. Records managers are currently defaulting to the shortest defensible retention period and hoping for the best. That approach works until the thread becomes evidence.
A web search for standard severance terms is an inquiry. A prompt instructing a model to draft a severance agreement for an employee being terminated for cause is an instruction. The latter demonstrates intent, and legal discovery targets intent.
When a model drafts a document and a person approves it, the person who signs is the legal author. The signature establishes the accountability. But the prompt history is the provenance. It shows what was considered, what was rejected, and what the author was actually trying to achieve.
Consider a VP who uses a model to draft a strategy memo. The final memo is clean. In litigation, opposing counsel asks for the prompt history. The prompts reveal the VP was actually trying to find reasons to terminate a contract. The prompt acts as the new marginalia, capturing the real thinking that never makes it into the final document.
Employees tend to treat AI chats like a whiteboard, while legal treats them like a deposition. An employee might ask the internal HR bot about medical leave, salary negotiation, or an HR complaint. The employer wants to retain the thread for records purposes. The employee’s lawyer argues it is private. The standard rules for employer-provided tools apply, but the policy has to explicitly state what is retained and why to close the gap between the employee’s mental model and legal reality.
The operational risk shifts when the AI takes autonomous action. An agent updates a supplier’s banking details in the ERP at 3:14 a.m. The system log shows the API call and the service account. Three months later, the supplier disputes the change. The agent action log is the only record showing the email it read, the tool call it made, and the approval it sought.
The system log retention policy was written for servers, not for decisions. IT operations typically delete server logs in 90 days. If an agent changes a financial record, the log of that change might need to live for seven years. The log is the only witness. If it is deleted, the action is unaccounted for. Agent logging requirements belong in the initial workflow design, not in a later records cleanup phase.
Legal hold is the pressure test for all of this. The hold notice goes to custodians, but custodians do not possess AI conversations the way they possess email. The data lives in a vendor admin console. The hold process requires new steps: identify platforms, get admin access, export, and preserve in a defensible format. You cannot put a legal hold on a chat you cannot find.
Shadow AI is the hold’s blind spot. Personal accounts, browser extensions, and unapproved tools contain relevant data that the organization cannot produce.
Then there is the vendor architecture. The vendor holds the logs, and the organization holds the liability. Most contracts do not address retention, export formats, or legal hold capabilities. A vendor’s deletion setting in the user interface is not a records policy. A conversation disappearing from the screen does not establish that backend copies or connector logs have been purged.
When legal asks for the drafting history of a customer notice, IT might export 50,000 conversations as a massive JSON file containing multi-turn threads, system prompts, and base64-encoded images. The e-discovery vendor’s ingestion tool chokes, and the review team resorts to manually reading unthreaded text. The retention period matters less if no one can produce a complete export.
An AI generation is a composite event. To reconstruct what happened, you need the user’s prompt, the system prompt active at that exact timestamp, the specific chunks of text retrieved by the RAG pipeline, and the model’s output. If you only log the prompt and the response, you are archiving the question and the answer while throwing away the textbook the model used to study.
System prompts dictate the boundaries of behavior. If an internal customer service bot hallucinates a refund policy on a Tuesday, IT needs the exact version of the system prompt running that day. Treating system prompts as static configuration files instead of version-controlled business policies breaks the chain of evidence.
An enterprise architect and a records manager might sit in a conference room looking at an architectural diagram for a new internal AI assistant. The records manager points to the vector database and asks how to apply a seven-year retention schedule to mathematical embeddings, and how to execute a legal hold on a RAG pipeline that updates its index every night. A vector database is just a filing cabinet that speaks math, but it is still subject to a legal hold.
If outside counsel cannot read the conversation as it occurred, the organization does not have a usable business record.