Examples of a Very Detailed A.I. Protective Order and Less Detailed Agreements and Orders

Is There a “Litmus Test” for a Categorical Privilege Log?
October 15, 2026
Parties Could Not Agree on an ESI Protocol; Neither Got What It Wanted
October 17, 2026
0
at
Categories
Tags

I have suggested that AI protective orders are becoming the standard of care.[1]  These orders limit the use or uses of AI by a recipient of discovery materials to review the materials produced by an opponent.  They clearly are important and have value in appropriate instances.

However, there is no standard form and the agreements vary greatly. Some cover only confidential information; others apply to all discovery material. Some list acceptable platforms by name; others describe functional requirements; and, some address named platforms and their configuration.  There has been discussion about the terms “consumer grade” AI v. “Enterprise” AI.  Thomsen-Reuters discusses Fiduciary-Grade AI.  The terms “open” and “closed” AI have been used–and criticized.

All protective orders are not created equal and they are not always fair.  I have echoed Craig Ball’s novel post on the need for equity in limiting an opponent’s right to use AI.  Another A.I. Protective Order – Part 10 quoting Craig Ball, The AI Protective Order Double Standard | Ball in your Court (Jul. 27, 2026).

One of the most detailed AI protective orders that I have seen was stipulated in Corent Technology, Inc. v. Amazon Web Services, Inc., 2026 WL 2924482 (C.D. Cal. Sep. 28, 2026).  It deals with both the use of AI on source code and more generally.  At the end of this post, I cite a number of less detailed examples.

As to source code, the Corent Technology order states:

Neither party shall use any software tools or applications on the Source Code Computer powered by or leveraging artificial intelligence or machine learning that automatically scan, analyze, or provide feedback on source code. The Producing Party shall accommodate reasonable requests by the Receiving Party that other mutually agreeable commercially available software tools for viewing and searching Source Code be installed on the Source Code Computer, provided that such other software tools are reasonably available to the Producing Party, non-destructive to the source code, and reasonably necessary for the Receiving Party to perform its review of the Source Code consistent with all the protections herein. The Receiving Party must provide the Producing Party with the licensed software tools at least three (3) business days in advance of the date upon which the Receiving Party wishes to have the additional software tools available for use on the Source Code Computer.

As to A.I. in general, the Corent Technology order states:

USE OF AI TOOLS

No party, and no person or entity authorized to receive materials under this Order, may input, upload, submit, or otherwise provide any Discovery Material—whether or not designated as Protected Information—into any modern artificial intelligence platform, including any generative, analytical, or large language model-based tool (“AI Tool”), unless all requirements of Section 12.1 and Section 12.2 are satisfied.

12.1 A party or person subject to this Order may use an AI Tool with Discovery Material only if the AI Tool is provided on an enterprise or commercial tier subscription and the Receiving Party has not configured the AI Tool to:

a) retain or store inputs (including prompts, documents, and metadata) for use beyond the session necessary to deliver the requested service, except as provided in Section 12.7.2, For clarity, this requirement does not prohibit the use of AI Tools that maintain a history of a user’s prompts and/or sessions, provided that any prompts containing Protected Information shall not be disclosed to any person not authorized to receive Protected Information under this Order;

b) use, incorporate, or reference inputs to train, fine-tune, retrain, or otherwise improve any AI model or system, whether that of the vendor or any third party, except as provided in Section 12.7.2, For clarity, this requirement does not prohibit the use of AI tools that incorporate or reference a user’s past prompts to optimize responses to subsequent prompts by the same user, provided that such AI tools (1) do not use, reference, or incorporate prompts or other inputs received from one user to respond to prompts from any other user; and (2) otherwise comply with all of the requirements in Section 12;

c) disclose inputs to any third party, except where strictly essential to facilitate delivery of the service; any such third party must be bound by confidentiality obligations no less protective than those required by this Order;

d) allow any human employee, contractor, or reviewer of the AI vendor to read, access, or review input content for any purpose other than immediate technical support explicitly requested by the party; and

e) make inputs or retained outputs accessible to any person not authorized to receive Protected Information under this Order.

12.2 In addition to the requirements of Section 12.1, a party or person may use an AI Tool with Discovery Material only if the AI vendor is contractually obligated to afford the Receiving Party the right to remove or delete all Discovery Material and AI-generated outputs from the vendor’s systems upon request, and in any event no later than sixty (60) days following the entry of a final non-appealable judgment or order, or the complete settlement of all claims asserted against all parties in this action (the “Conclusion of This Action”). The Receiving Party shall: (a) within fourteen (14) days following the Conclusion of This Action, take all reasonable steps necessary to ensure deletion of all Protected Material uploaded and/or output by AI tools during this action. The Receiving Party may meet this requirement by submitting a deletion request to the vendor if the vendor accepts deletion requests during the term of its vendor agreement with the Receiving Party; or, if the AI vendor does not accept such requests, by manually deleting all uploaded information over the AI tool’s user interface; and (b) within sixty (60) days following the Conclusion of This Action, provide the Producing Party with written certification and documentation demonstrating that the Receiving Party took all reasonable steps necessary to delete all Discovery Material uploaded to AI tools using the procedures and means provided by the vendor(s), as applicable.

12.3 Any party intending to use an AI Tool with Discovery Material must, prior to such use:

a) retain written documentation (including the vendor’s data processing agreement, terms of service, or equivalent contractual instrument) demonstrating that the vendor’s commitments satisfy Sections 12.1 and 12.2; and

b) make such documentation available to the Producing Party within five (5) business days of a written request.

12.4 A party that intends to use an AI Tool with Discovery Material produced by the other party must provide written notice to the Producing Party at least seven (7) business days before first use, except with respect to AI Tools pre-approved under Section 12.6. Such notice shall identify:

a) the name, version, and operator of the AI Tool;

b) the categories of Discovery Material the Receiving Party intends to process; and

c) a representation that Sections 12.1 and 12.2 are satisfied, accompanied by the documentation required by Section 12.3(a).

The Producing Party shall have five (5) business days to object in writing, stating with particularity the basis for objection. If a timely objection is served, the parties shall meet and confer within three (3) business days. If the dispute is not resolved, the Receiving Party may not proceed with such AI Tool use until the Court resolves the dispute pursuant to Local Rule 37-1 et seq. and Section 3 of Judge McCormick’s Procedures.

12.5 Notwithstanding any other provision of this Section 12, no party may use any AI Tool, regardless of vendor contractual protections, to review, analyze, summarize, or otherwise process any Discovery Material designated as HIGHLY CONFIDENTIAL—SOURCE CODE. This prohibition is absolute and applies whether such Source Code material is accessed on the Source Code Computer, in printed form, in electronic excerpts, or in any other form or medium.

12.6 The parties agree that the following AI Tools, when used at the enterprise or commercial tier identified below and subject to the configuration requirements in this subsection, satisfy the requirements of Sections 12.1 and 12.2 based on each vendor’s published enterprise terms of service, data processing addendum, and security certifications as of the Effective Date of this Order. Use of any AI Tool pre-approved under this Section 12.6 shall not require the pre-use notice otherwise required under Section 12.4.

a) Microsoft Copilot, including Microsoft 365 Copilot and Copilot Cowork, when deployed within a Microsoft 365 Enterprise or Business tenant governed by Microsoft’s enterprise Data Protection Addendum (and not the free or consumer-facing Copilot product available at copilot.microsoft.com), satisfies the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s tenant is configured to disable any consumer connectors or web-grounding features that would route Discovery Material outside the enterprise data-processing boundary; and (ii) the Receiving Party has not enabled any consumer-tier or non-Enterprise Copilot product for use with Discovery Material.

b) Lexis+ AI (LexisNexis), at the firm’s standard commercial or enterprise subscription tier, satisfies the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s account is configured under LexisNexis’s then-current commercial terms and its published zero-training and zero-retention commitments applicable to user-submitted content; and (ii) the Receiving Party has not enabled any consumer or free-tier LexisNexis AI product for use with Discovery Material.

c) Westlaw AI and CoCounsel (Thomson Reuters), at the firm’s standard commercial or enterprise subscription tier, satisfy the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s account is governed by Thomson Reuters’s then-current commercial terms, including its non-retention API arrangements with underlying model providers and its contractual prohibition on third-party model providers retaining or training on customer data; and (ii) the Receiving Party has not enabled any consumer or free-tier Westlaw AI or CoCounsel product for use with Discovery Material.

d) Patlytics (patlytics.ai), at the firm’s standard commercial or enterprise subscription tier, satisfies the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s account is configured under Patlytics’s then-current customer terms, including its published non-training commitment and its non-retention agreements with underlying third-party AI services; and (ii) the Receiving Party has not enabled any consumer or free-tier Patlytics product for use with Discovery Material.

e) Perplexity Enterprise (Pro or Max tier) satisfies the requirements of Sections 12.1 and 12.2, based on Perplexity’s Enterprise Terms of Service, Data Processing Addendum, and SOC 2 Type II attestation as of the Effective Date of this Order, provided that: (i) the Receiving Party’s Enterprise instance has Zero Data Retention enabled or, alternatively, has configured the shortest available data retention period; and (ii) the Receiving Party has not enabled any consumer-tier or non-Enterprise Perplexity product for use with Discovery Material.

f) Claude (Anthropic), at the firm’s standard commercial or enterprise subscription tier, satisfies the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s subscription is configured to disable any consumer connectors or web-grounding features that would route Discovery Material outside the enterprise data-processing boundary; and (ii) the Receiving Party has not enabled any consumer-tier or non-Enterprise Claude product for use with Discovery Material.

g) Harvey (harvey.ai) satisfies the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s subscription is configured to disable any consumer connectors or web-grounding features that would route Discovery Material outside the enterprise data-processing boundary; and (ii) the Receiving Party has not enabled any consumer-tier or non-Enterprise Harvey product for use with Discovery Material.

h) Legora aOS (Legora) satisfies the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s subscription is configured to disable any consumer connectors or web-grounding features that would route Discovery Material outside the enterprise data-processing boundary; and (ii) the Receiving Party has not enabled any consumer-tier or non-Enterprise Legora product for use with Discovery Material.

i) Crane Patents satisfies the requirements of Sections 12.1 and 12.2, provided that: (i) the Receiving Party’s subscription is configured to disable any consumer connectors or web-grounding features that would route Discovery Material outside the enterprise data-processing boundary; and (ii) the Receiving Party has not enabled any consumer-tier or non-Enterprise Crane Patents product for use with Discovery Material.

12.7.1 No party or authorized recipient of Discovery Material shall use any Discovery Material, or any AI-generated output derived therefrom, within any AI Tool workspace, project, index, session, or other AI-Tool-hosted environment that is accessed, maintained, or used for any matter other than this action. Each party shall configure its use of AI Tools such that Discovery Material and any AI-generated outputs derived therefrom are logically segregated from unrelated matters, and shall not carry over, migrate, or otherwise make available such Discovery Material or derived outputs to any workspace, project, index, or session unrelated to this action.

12.7.2 For the avoidance of doubt, nothing in this Section 12 prohibits an AI Tool from retaining Discovery Material or AI-generated outputs derived therefrom within a single matter-specific workspace, project, index, or session dedicated to this action for the purpose of enabling follow-up queries, retrieval-augmented generation, context-preserved analysis, or similar within-matter functionality, provided that (i) such retention is confined to the matter-specific environment and does not train, fine-tune, or otherwise update the underlying model or any model used by any other party, matter, or user; and (ii) the matter-specific environment remains subject to the deletion obligations set forth in Section 12.2. [emphasis added]

For more information on, and examples of, less detailed A.I. protective orders, a discussion of standard of care, and a discussion of the possible equity impacts of such orders, please visit:

USE OF ARTIFICIAL INTELLIGENCE

Should a Party elect to utilize artificial intelligence (“AI”) to assist in reviewing, analyzing, or summarizing discovery material produced or exchanged in this litigation, the Party shall take all necessary steps to ensure that the application, service, or analytical software is fully containerized. “Fully containerized,” as used in this Order, means an AI tool that does not retain the substance of a prompt or documents reviewed, share the substance of a prompt or documents reviewed for training of large language models, or use the substance of a prompt or documents reviewed in any other matter or inquiry other than this litigation. For the avoidance of doubt, this restriction expressly applies to the use of non-containerized advanced large language models (such as publicly available large language models), generative AI tools, and other advanced AI systems, including, but not limited to, OpenAI, Gemini, LLAMA, MidJourney, and Stable Diffusion, but this provision does not limit the use of services leveraging the technology underlying these generative AI tools in a fully containerized environment, including, but not limited to, Copilot Harvey, Relativity aiR, DISCO Cecelia, Everlaw AI, Syllo, Alchemy, Lexis+ AI, Epiq AIDA, Lighthouse AI, Westlaw AI, ChatGPT Enterprise, Microsoft 365 Copilot Enterprise, Claude Enterprise, NotebookLM Pro and Ultra, and Gemini Pro and Ultra. Before submitting any Protected Material to a fully containerized AI tool, a receiving party shall ensure that it (or its vendor) can delete all such Protected Material from the AI tool at the conclusion of this matter, including any derivative information stored within the tool. The obligations and restrictions of this paragraph apply even where the Protected Material has been anonymized.

  • S.A.  v. Lockhart, 2026 WL 3003727 (S.D.N.Y.  Oct. 6, 2026)(by consent):

Restrictions on Use of Artificial Intelligence Tools to Process Disclosure Materials.

a. “AI tool” means any automated system that uses machine learning, or similar techniques to process inputs and generate outputs, recommendations, or predictions, including but not limited to large language models, generative AI services, or AI-assisted software tools, whether cloud-based or otherwise.

b.  The defense team will not submit Disclosure Materials to a publicly accessible version of an AI tool (e.g., ChatGPT, Claude, Grok, Gemini, Copilot, Perplexity, Midjourney, Canva). The defense team will not submit Disclosure Materials to an AI tool for which the AI tool provider or vendor (e.g., OpenAI, Anthropic, Microsoft, Google) uses submitted data for its own model training, allows submitted data to be publicly accessed, discloses submitted data to third parties, or, except as specified below, retains submitted data. Publicly accessible AI tools pose unique risks to the security and integrity of Disclosure Materials, given the practical inability to claw back or delete data once it has been incorporated into a model.

c.  The defense may submit Disclosure Materials to an AI tool (i) that maintains the confidentiality of Disclosure Materials; (ii) that will not expose any Disclosure Materials to third parties not authorized under this Protective Order to receive such materials; (iii) that will not retain or use any Disclosure Materials for model training; and (iv) all Disclosure Materials will be removed from the AI tool(s) at the conclusion of this case.

d.  The Government will not submit any materials disclosed by the defense pursuant to Federal Rules of Criminal Procedure 26.2, 32.1 or other defense disclosure obligations (“Defense Materials”) to a publicly accessible version of an AI tool. The Government will not submit Defense Materials to an AI tool for which the AI tool provider or vendor uses submitted data for its own model training, allows submitted data to be publicly accessed, discloses submitted data to third parties, or, except as specified below, retains submitted data.

e.  The Government may submit Defense Materials to an AI tool (i) that maintains the confidentiality of Defense Materials; (ii) that will not expose any Defense Materials to third parties not authorized under this Protective Order to receive such materials; (iii) that will not retain or use any Defense Sealed Materials for model training; and (iv) all Defense Materials will be removed from the AI tool(s) at the conclusion of this case.

  • S.A. v. Santos, 2026 WL 3003653 (Oct. 6, 2026)(same, by consent);
  • S.A. v. Robinson, 2026 WL 3003677 (Oct. 6, 2026)(same).
  • S.A. v. Peplow, 2026 WL 3026474 (E.D. Cal. Oct. 8, 2026)(stipulation):

Artificial Intelligence Tools

  1. No person or entity authorized to have access to protected material under the terms of the requested order shall input, transmit, upload, submit, quote, feed, process, generate output from, or otherwise expose any protected material received pursuant to the requested order to any artificial intelligence (“AI”) tool absent the prior written consent of the government or an order of the Court following a properly noticed motion to which the government has an opportunity to respond, unless that AI tool—a) is an enterprise-grade platform that counsel for the defendant has licensed; b) is subject to a binding written agreement that (i) requires the provider to keep all user-supplied data strictly confidential, and (ii) expressly prohibits the provider from using such data for training, fine-tuning, product improvement, or any purpose other than providing the contracted-for services; and c) employs technical and organizational security measures reasonably designed to prevent any unauthorized access, disclosure, or use of protected material.

  2. The obligations and restrictions of this section apply even where the data or the protected material has been anonymized. “AI tool” means any automated system that uses statistical modeling, machine learning, or similar techniques to process inputs and generate outputs, recommendations, or predictions, including but not limited to large language models, generative AI services, or AI-assisted software tools, whether cloud-based or otherwise.

  3. By participating in this agreement, counsel for the defendant certifies: (i) they have implemented reasonable measures to ensure, if using any AI tool, it will maintain the protected discovery’s confidentiality as required by this Agreement and (ii) they will ensure all protected discovery is deleted from the tool once this case concludes.

  4. Under no circumstances will any member of the defense team submit protected material to a publicly accessible AI system that retains and uses submitted data to train models. Such AI tools pose unique risks to the security and integrity of protected material, given the practical inability to claw back or delete data once it has been incorporated into a model.

  • S.A. v. Sarris, 2026 WL 2937892, at *2 (S.D.N.Y.  Sep 30, 2026)(by consent).
  • S.A. v. DeJesus, 2026 WL 3034296 (S.D.N.Y. Oct. 9, 2026)(by consent).

Note: In a recent decision, the District of Maryland wrote: “In addition, Campbell must ensure that any use of generative artificial intelligence does not violate the stipulated order governing confidential materials. See ECF 21. TidalHealth expresses concern that Campbell violated the February 27, 2026 Protective Order’s prohibition on submitting discovery material to public generative artificial intelligence tools. ECF 41-1 at 11; see ECF 21 at ¶ 8 (imposing limitations on use of generative artificial intelligence). Campbell denies doing so. ECF 45 at 3. If future filings suggest improper submission of discovery materials to generative artificial intelligence tools, the Court will be more inclined to issue a show cause order and consider sanctions.” Campbell v. TidalHealth, Inc., 2026 WL 2162749, at *10  (D. Md. Jul. 28, 2026)(Austin, J.)(emphasis added).  This case was discussed in a prior post.

____

[1] Three More A.I. Protective Orders (Oct. 9, 2026).

Share
mm
Michael Berman
About Michael

Related posts

October 17, 2026

Parties Could Not Agree on an ESI Protocol; Neither Got What It Wanted

Read more
October 15, 2026

Is There a “Litmus Test” for a Categorical Privilege Log?

Read more
October 14, 2026

Defendant Claimed Video of Abuse Was a “Deepfake”; Victim Was Asleep and Could Not Attest to Abuse

Read more