Before You Feed the Other Side’s Documents to AI, Read the Protective Order

Oct 22

The short answer

On October 2, 2026, two federal courts, one in Nebraska and one in Wisconsin, entered protective orders that limit what the parties may feed into artificial intelligence tools. A few days earlier, a federal court in California entered one that is 38 pages long, covers every document exchanged in the case, and lists by name the AI products the lawyers are allowed to use. In the same weeks, criminal protective orders in the Southern District of New York named ChatGPT, Claude, Grok and Gemini as examples of tools the defense may not use on the government's evidence.

None of these orders is a national rule, and many were agreed to by the parties. But they now share a common shape: public and consumer AI tools are off limits for the other side's documents, while enterprise tools are allowed, but only under contracts that bar the provider from training on, keeping or disclosing what you upload. If your company or your lawyers plan to run AI over discovery, the protective order is now where that question gets decided. If the order says nothing, expect a fight later.

Why courts care

Discovery depends on a promise: the other side will see your documents, but only for this case, and you can get them back if something goes wrong. AI tools strain that promise. Once a document goes into a tool whose provider keeps inputs or trains on them, getting it back may be impossible.

Magistrate Judge Angel D. Mitchell of the District of Kansas put the problem plainly in Jeffries v. Harcros Chemicals, Inc. on March 25, 2026. She cited "the inability to effectively claw back information from the AI Tool," and warned that without limits, "parties may err on the side of under-producing potentially responsive documents." Her order covered all discovery materials, not just documents marked confidential, and it barred only "open" AI tools. As she explained, the defendants' proposal she adopted "does not foreclose a party from using any AI Tools; it only prohibits using open AI Tools." (The parties later asked the court to withdraw the amended order, and on July 16, 2026 it reinstated the original. The reasoning still gets cited.)

A court-written clause

Five days later, in Morgan v. V2X, Inc., Magistrate Judge Maritza Dominguez Braswell of the District of Colorado declined to adopt either side's proposed language and wrote her own. Later orders use similar concepts:

No party or authorized recipient may input, upload, or submit CONFIDENTIAL Information into any modern artificial intelligence platform, including any generative, analytical, or large language model-based tool ("AI"), unless the AI provider is contractually prohibited from: (1) storing or using inputs to train or improve its model; and (2) disclosing inputs to any third party except where such disclosure is essential to facilitating delivery of the service.

The order also requires that the provider allow deletion "upon request," and that anyone using AI "retain written documentation of these contractual protections." In practice, that rules out most free and low-cost consumer tools.

The October wave

The newer orders vary in how much they say:

Hoffman v. University of Nebraska Medical Center (D. Neb. Oct. 2, 2026). The parties jointly asked for an order barring anyone who receives confidential discovery or deposition testimony from uploading it to any "open-source artificial intelligence platform or service" without the producing party's written consent. The ban applies "regardless of whether the artificial intelligence platform or service represents it will maintain the confidentiality" of what is submitted. Closed tools such as Harvey, Westlaw, LexisNexis and Servient's AI Canvas are expressly allowed.
ANR Pipeline Co. v. B&B Metal Processing Co. (E.D. Wis. Oct. 2, 2026). Judge J.P. Stadtmueller added the AI terms to the parties' proposed order himself. AI may be used on discovery only in "a secure environment" under enforceable contract terms that prohibit the provider "from retaining, using, disclosing, selling, or using the materials to train, improve, or develop any AI system," and nothing produced may go into "any publicly available or consumer-based AI platform."
Corent Technology, Inc. v. Amazon Web Services, Inc. (C.D. Cal. Sept. 28, 2026). This stipulated order in a patent case is the most detailed yet. It reaches all discovery material, "whether or not designated" confidential. It requires an enterprise or commercial subscription and forbids keeping inputs beyond the session, with a limited exception for a workspace dedicated to the case. It requires advance notice before using any tool not on the pre-approved list, with a right to object. That list includes Microsoft Copilot, Lexis+ AI, Westlaw AI and CoCounsel, Claude and Harvey. And it bars AI entirely from material designated as source code: "This prohibition is absolute."
Criminal cases in the Southern District of New York. Protective orders entered in United States v. Amanuel (Oct. 2, 2026) and United States v. Lockhart and United States v. Robinson (both Oct. 6, 2026) provide that the defense "will not submit Disclosure Materials to a publicly accessible version of an AI tool (e.g., ChatGPT, Claude, Grok, Gemini, Copilot, Perplexity, Midjourney, Canva)." Tools that keep the materials confidential and do not use them for model training are allowed, and "all Disclosure Materials will be removed from the AI tool(s) at the conclusion of this case." In Lockhart, parallel limits also bind the government in handling the defense's materials.

The fairness problem

Not everyone thinks this is progress. E-discovery commentator Craig Ball has called the enterprise requirement "a toll booth that only the well-heeled can pass through," and argued that "price has never been, and should never become, a proxy for diligence." A large company with enterprise licenses can comply easily. A small business, or a person representing himself, may be shut out of tools that the other side uses freely. Judge Dominguez Braswell saw the tension in Morgan, which involved a self-represented plaintiff. She asked: "Does that mean that anyone with a Gmail account has forfeited all rights to confidentiality and privacy?" Courts have not resolved this. Expect it to come up when parties negotiate these clauses.

Experts who use AI: the prompts split

A separate fight concerns experts. On September 29, 2026, in Villanueva v. Las Vegas Metropolitan Police Department, District Judge Anne R. Traum of the District of Nevada set aside in part a magistrate judge's order requiring an expert to produce his entire ChatGPT history. She drew a line:

Disclosed: AI-generated case summaries the expert considered. These are "facts or data" under Federal Rule of Civil Procedure 26(a)(2)(B)(ii). The order refers to the log as the only place the defense could review alleged "hallucinated case citations" the expert relied on or considered.
Protected: the expert's prompts and questions, which the court likened to online research queries and treated as revealing mental impressions. Also protected are an AI-assisted deposition outline and AI-assisted drafts of the report.
No waiver: ChatGPT "is not a person, but was an application used in this instance as a research, drafting, and editing program."

A magistrate judge in Connecticut went the other way on prompts in May. In Conservation Law Foundation, Inc. v. Shell Oil Co., the court ordered the plaintiff to search for and produce any prompts its expert used to cull Shell's document production, treating that process as "an aspect of" the expert's methodology. The plaintiff, which says no such prompts exist, has objected, and argument on the objection is reportedly set for November 3, 2026. Neither ruling binds Florida courts. The practical point is the same either way: if your expert uses AI, decide at the outset what will be disclosed and keep the factual inputs separate from the prompts.

Your own AI use

Courts have also addressed a party's own use of AI. In Warner v. Gilbarco, Inc., a federal magistrate judge in Michigan refused to order a self-represented plaintiff to hand over her AI materials, reasoning that ChatGPT and similar programs "are tools, not persons," so using them did not waive work-product protection. Morgan likewise held that Rule 26(b)(3) "offers Plaintiff some level of work product protection in connection with his use of AI," but ordered him to disclose which AI platform he had used.

The limits matter. In United States v. Heppner, Judge Jed S. Rakoff of the Southern District of New York reportedly held that a criminal defendant's own exchanges with a public AI platform, made without his lawyers' direction, were neither privileged nor work product. Who directed the work, for what purpose, and on what platform will drive the answer.

The next risk: documents that talk to the machine

Earlier this month we wrote about a Connecticut litigant who hid instructions for AI tools in a court filing. See The Filing Was Talking to the Machine. The Judge Was Reading It on Paper. The court there warned that a summary drawn from a document carrying a hidden instruction "may be skewed toward one party's narrative while counsel remains unaware of the cause." The same technique can sit in a document production, an expert report or a witness statement. If you are going to run AI over the other side's documents, the protective order covers only half the job. The other half is checking what you feed the tool.

What to do now

Raise AI in the protective order and ESI protocol at the start. Negotiate it early. A dispute in the middle of discovery costs more.
Separate your own documents from the other side's. Most orders restrict what you do with material you receive, not what you do with your own.
Know your tool's contract. Confirm that the provider does not train on inputs, keep them beyond what the service needs, or share them, and that you can delete them. Keep the paperwork. Morgan requires it.
Plan expert AI use before the report. Keep the factual material an expert considers separate from prompts and drafts, and expect to produce the former.
Screen incoming documents. Compare what a document shows with the text a machine extracts from it. Look for white or microscopic text, and check AI summaries against the source.
Mind the ethics rules. In Florida, the Bar's Ethics Opinion 24-1 (January 19, 2024) already advises lawyers to obtain a client's informed consent before using a third-party generative AI program in a way that would disclose confidential information. The questions courts now write into protective orders are ones Florida lawyers should already be asking.

Sources

Jeffries v. Harcros Chemicals, Inc., No. 2:25-cv-02352-KHV-ADM, ECF No. 152 (D. Kan. Mar. 25, 2026), Justia; order vacating amended protective order, ECF No. 203 (D. Kan. July 16, 2026).
Morgan v. V2X, Inc., No. 1:25-cv-01991-SKC-MDB, ECF No. 65 (D. Colo. Mar. 30, 2026), CourtListener.
Hoffman v. Univ. of Neb. Med. Ctr., No. 8:25-cv-00725, ECF No. 29 (D. Neb. Oct. 2, 2026), CourtListener.
ANR Pipeline Co. v. B&B Metal Processing Co., No. 2:26-cv-01366-JPS, ECF No. 19 (E.D. Wis. Oct. 2, 2026), CourtListener.
Corent Tech., Inc. v. Amazon Web Servs., Inc., No. 8:26-cv-00194-JVS-DFM, ECF No. 53 (C.D. Cal. Sept. 28, 2026), CourtListener.
United States v. Lockhart, No. 22 Cr. 179 (CS), ECF No. 43 (S.D.N.Y. Oct. 6, 2026); United States v. Robinson, No. 26 Cr. 336 (AT), ECF No. 18 (S.D.N.Y. Oct. 6, 2026); United States v. Amanuel, No. 26 Cr. 428 (JGK), ECF No. 26 (S.D.N.Y. Oct. 2, 2026). See also Michael D. Berman, "Three More A.I. Protective Orders," E-Discovery LLC (Oct. 9, 2026).
Villanueva v. Las Vegas Metro. Police Dep't, No. 2:24-cv-00125-ART-DJA, ECF No. 112 (D. Nev. Sept. 29, 2026), Justia.
Conservation Law Found., Inc. v. Shell Oil Co., No. 3:21-cv-00933-VDO, ECF No. 970 (D. Conn. May 18, 2026); see Mayer Brown, "Federal Court Splits on Disclosure of Expert Witness AI Prompts," mayerbrown.com (Oct. 2026).
Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026).
United States v. Heppner, No. 25 Cr. 503 (JSR) (S.D.N.Y. Feb. 17, 2026); see O'Melveny, omm.com.
Elliott v. New York Bariatric Group, LLC, No. AAN-CV-25-6066141-S (Conn. Super. Ct. Aug. 6, 2026) (Mem. of Decision, Entry No. 186.00).
Craig Ball, "The AI Protective Order Double Standard" (July 27, 2026), as reported by eDiscovery Today.
Sidley Austin, "Generative AI in Discovery: Protective Orders as an Emerging Point of Dispute," Data Matters (Apr. 6, 2026).
The Florida Bar, Ethics Opinion 24-1 (Jan. 19, 2024), floridabar.org.

Disclaimer

This post discusses publicly reported legal developments for general informational purposes. It is not legal advice, it does not create an attorney client relationship, and it does not reflect the firm's position in any pending matter. Outcomes depend on the specific facts and the governing law of the relevant jurisdiction.

Patrick Dempsey