As generative AI becomes embedded in everyday business operations, organizations are increasingly treating AI-generated content as ordinary business records. AI systems now draft reports, summarize meetings, analyze contracts, generate code, prepare customer communications, and support operational and compliance decisions.

In many cases, the AI-generated output is retained, relied upon, and incorporated into official business processes.

What often is not preserved, however, is the information necessary to explain how that output was created. For example, a prompt may be deleted or the documents used to generate the response may later change. As such, by the time litigation or an internal investigation arises, organizations may discover that they possess the final record but lack the ability to reconstruct its origins.

This emerging gap presents a significant e-discovery and information governance challenge in the AI era: the missing chain of custody for AI-generated business records.

Traditional business records generally carry information about their origins. An email identifies its sender and recipients. A document often contains metadata, revision history, and author information. Database records can frequently be traced to a particular transaction or user activity. But, AI-generated records are different.

Consider an employee who uses the firm's enterprise Copilot to synthesize and summarize a collection of documents to create a firm policy. After revising the prompt through several iterations, the employee incorporates the final AI-generated output into a Word document that, after human input and edits, eventually becomes an integral firm policy.

The prompt, along with its iterations and outputs, is not saved. Additionally, the underlying source documents are later revised, deleted, or replaced, and no audit trail identifies the specific versions on which the AI relied.

This scenario illustrates how preserving only the final output can make it difficult — or impossible — to reconstruct the origin of an AI-generated business record.

While the completed record may exist, it, in and of itself, may reveal little or nothing about:

•The prompt that initiated the request;•The documents or databases consulted by the system;•The model version used;•System-level instructions or guardrails;•Intermediate outputs or revisions;•Human edits and approvals; or•Automated actions triggered by the result.

These details are not merely technical artifacts. They may ultimately determine whether a business record can be authenticated, understood, challenged, or defended in litigation.

The Federal Rules do not contain AI-specific preservation requirements, but the duty to preserve potentially relevant electronically stored information (ESI) applies regardless of whether that information was created by a human or an AI system.

Under Rule 37(e), parties must take reasonable steps to preserve relevant ESI once litigation is anticipated. If information is lost and cannot be restored or replaced, courts may impose remedial measures and, in certain circumstances, sanctions.

The challenge is identifying what constitutes the relevant ESI in an AI environment. In many cases, the final output may not be the only relevant information. Prompts, conversation histories, uploaded documents, retrieval results, audit logs, system instructions, and approval records may all become important.

Organizations therefore face a critical governance question: if an AI-generated report becomes evidence, what information must be preserved to understand how it was created? Organizations may need to ask and demonstrate what information entered the AI system; what the system generated at the time; what changes humans made to that output; and, what actions were taken based upon it.

But fear not — I am not suggesting that organizations need to preserve every AI interaction indefinitely. Such an approach would be costly, difficult to manage, and potentially inconsistent with privacy and data-minimization obligations.

However, for significant business processes, organizations should consider preserving a minimum set of origin information, including prompts and prompt revisions; uploaded source materials; documents retrieved by the system; model identifiers and version information; original AI-generated outputs; human edits and approvals; and, timestamps.

The appropriate level of preservation should be proportional to the significance of the use case. An AI-generated employee lunch menu presents a different risk profile than an AI-generated compliance report, investigation summary, insurance coverage analysis, or financial recommendation.

Importantly, many legal hold processes are designed around traditional data sources such as email, cloud storage, messaging platforms, and databases. Increasingly, those procedures will need to address enterprise AI systems as well.

As such, custodian interviews should include questions regarding what AI tools were or are used; whether prompts and outputs were or are retained; whether documents were uploaded into AI systems when creating a particularly relevant document; whether AI-generated content was incorporated into a particularly relevant document; and whether any automated actions occurred.

Organizations should also understand retention practices before litigation occurs. Some platforms automatically delete conversation histories, logs, or outputs after relatively short periods. Others retain extensive audit data but provide limited export capabilities. Understanding these retention periods and, more importantly, how to disable any auto-delete function is critical in making sure relevant prompts and outputs are preserved.

You may be asking, "Why can't I just re-run the prompt and reconstruct the output?" Unfortunately, this is not a panacea for the above problems.

Identical prompts fed into an AI-system may produce different outputs over time. As a result, organizations cannot assume they will be able to recreate an AI-generated record months or years later simply by rerunning the same request. Reconstruction may fail because:

•AI providers routinely update, modify, or retire models.

•Many enterprise AI systems rely on retrieval from connected repositories; as such, documents available when a response was generated may later be edited or deleted.

•Enterprise AI tools frequently apply system prompts, policies, templates, and guardrails that users never see. Preserving only the user's prompt may omit critical portions of the instruction set.

•Employees frequently copy AI-generated content into emails, reports, presentations, or case management systems. Once edited, determining what was generated by the AI and what was added by a human may become difficult or impossible.

•Agentic AI workflows may interact with databases, APIs, internal applications, and third-party services, so no single system may retain a complete record of the transaction.

The result is that organizations may possess a seemingly important business record but lack the information necessary to explain how it came into existence.

Many organizations cannot preserve AI sources unless their vendor provides access to it. Accordingly, discovery readiness should become part of the procurement process.

Before deploying enterprise AI systems, organizations should evaluate whether providers can retain prompts and outputs, preserve audit logs, track model versions, identify retrieved sources, export data and metadata, implement legal holds, and provide preservation assistance during litigation.

Organizations should not assume that assurances regarding privacy or non-training of customer data address these issues. Retention, preservation, auditability, and training are separate considerations.

In the near future, litigants, regulators, auditors, and courts may increasingly ask organizations to identify the information that informed an AI-assisted decision, the instructions that shaped it, and the individuals who approved it. If the organization preserved only the final output, those questions may be difficult to answer.

As stated previously, the solution is not unlimited retention; rather, organizations should develop risk-based provenance frameworks that preserve sufficient information to explain consequential AI-generated records and the decisions that flow from them.

In the eDiscovery world, preserving the document has never been enough — the chain of custody related to and authentication of a document is of equal importance. The same is true for the preservation of AI-generated material. As such, organizations must be able to establish where such material came from, how it was created, and whether it can be trusted.

As AI-generated content becomes part of the ordinary course of business, the same basic eDiscovery principles apply. The challenge is that the chain of custody no longer ends with the document itself. It now extends to the prompts, models, sources, system instructions, and human interactions that collectively produced it.

Organizations that begin preserving that source data today will be significantly better positioned when tomorrow's litigation teams ask a simple question: How did this record come to exist?