The AI Protective Order Double Standard

27 Monday Jul 2026

Tags

ai, artificial-intelligence, chatgpt, eDiscovery, ESI Protocols, generative-ai

I’ve spent forty-odd years watching the discovery process get weaponized, not always to protect legitimate interests, but often to price opponents out of the fight. I’ve seen it with discovery, privacy and security protocols, with TAR disputes and with forensic examination demands that cost more than the case is worth. Every new technology becomes a vector for cost-shifting dressed up as diligence. AI protective orders are the latest iteration, using the same playbook.

Consider two rulings handed down the same day this June in the Southern District of New York. Orechovesky v. BNY Administrative Services, LLC, No. 1:25-cv-08517, 2026 WL 1725149 (S.D.N.Y. June 15, 2026), requires a party receiving protected material to certify that any AI tool used to process it will maintain confidentiality, won’t expose materials to unauthorized third parties, won’t train on inputs, and will allow deletion at the conclusion of the case. Sensible requirements. I don’t quarrel with them. The Court also requires the LLM to operate “within a closed, private, limited, secure universe”—whatever that means—and lists Relativity’s aiR Platform, Westlaw’s CoCounsel, and Gemini for Google Workspace (Enterprise or Business editions) as acceptable, without saying whether those tools exemplify the standard or are simply agreed-upon exceptions to it.

The second case, Pujas v. BDO USA, P.C., 2026 WL 1724307 (S.D.N.Y. June 15, 2026), goes further: it bars uploading confidential material to any AI tool unless the platform is “enterprise-grade,” backed by a binding agreement prohibiting the provider from using the data for training or product improvement, a so-called DPA (for Data Processing Agreement).

Enterprise-grade?!? It’s not clear what that means nor is it settled in law; but the notion is gaining traction in CLE panels and proposed orders: the assumption that only expensive, purpose-built legal AI platforms can satisfy requirements that every major consumer AI platform already satisfies. That assumption is wrong on the technology, wrong on the contracts, and wrong on the policy.

Courts are already proving my point. In Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB (D. Colo. Mar. 30, 2026), the District of Colorado adopted a similar standard and then candidly recognized, “that practically speaking, and in light of the current state of AI, this provision will (at least for now) bar the parties from using most, if not all, mainstream low-to-no cost AI to process Confidential Information.” If other courts follow uncritically, it will do what every prior technology-gatekeeping effort has done: widen the gap between well-funded litigants and everyone else, while delivering no meaningful improvement in data security. My hope is that this post will shed light on a distinction without a difference so as to not hinder the use of properly configured, ‘consumer grade’ AI for processing sensitive data.

Same Engine, Different Price Tag

The legal AI industry doesn’t advertise it, but all the legal AI products on the market run on the same small handful of foundation models including OpenAI’s GPT series, Anthropic’s Claude, Google’s Gemini and are hosted on the same cloud infrastructure, like Azure, AWS or Google Cloud. Whether you access that model through a $150,000-per-year legal AI platform or a $20-a-month ChatGPT Plus or Claude Pro subscription, your data hits the same servers, gets processed by the same chips and is governed by the same operational security posture at the infrastructure layer (the actual servers and networks where data is processed).

The legal AI vendors do add value through workflow design, legal-specific prompting, citation checking, integration with document review tools and such; but what the vendors don’t add is a fundamentally different security architecture at the AI. The model doesn’t know whether it’s being called by a BigLaw firm’s bespoke platform or by little ol’ me. The bytes don’t care about the price tag on the Application Programming Interface (API) wrapper.

Certainly, the default security settings aren’t identical across vendors. Anthropic’s consumer plans—Free, Pro, and Max—don’t train on your conversations unless you affirmatively opt in. OpenAI’s consumer ChatGPT does the opposite: it trains on your conversations by default, unless you affirmatively opt out under Data Controls in Settings.

If you’re relying on a consumer subscription to satisfy a protective order, choosing the correct setting isn’t optional housekeeping; it’s the ballgame. For tools accessing the raw API, training the model on client data is not a concern; both Open AI and Anthropic have defaulted to “no training” for years.

When the ‘enterprise grade’ vendor tells you that your data is protected by their SOC 2 Type II attestation (an independent audit confirming security controls are in place and working), contractual commitments, and zero-data-retention processing (meaning your inputs aren’t stored after the response is generated), they’re describing protections that flow from the foundation model provider’s policies. The ‘consumer grade’ user benefits from the same no-training setting and the same underlying infrastructure security — though not from a zero-data-retention agreement, which is a negotiated feature, not a default at any price tier. What a consumer account gets instead is a short, fixed retention window, which I’ll come back to. The vendor’s DPA doesn’t cause OpenAI or Anthropic to not train on inputs. It merely documents a practice those providers already follow for every API customer, because their Fortune 500 clients demand it and because training on customer data creates legal liability they don’t want.

The security isn’t in the markup. It’s in the infrastructure. And the infrastructure is shared.

What the Contracts Actually Say

Compare the enterprise DPAs and the consumer terms of service, and you’ll find the operative commitments converge: no sharing with third parties, deletion on request, and—for the training question, once you’ve checked the box covered above—no training on inputs either. “The DPA says it in forty pages, dressed up with indemnification clauses and liability caps. The terms of service say it in four paragraphs; but the words that matter are substantively identical.

The DPA adds audit rights, breach notification timelines, and deletion SLAs (service-level agreements specifying timelines for action). These sound important, but what do they mean in practice?

Audit rights. No law firm audits OpenAI. No law firm sends a forensic examiner in to audit Microsoft’s data centers. The “audit right” exists to be pointed to in a certification, not to be exercised. It’s a clause that lets a general counsel tell a managing partner that the box is checked. Actual security verification comes from the provider’s SOC 2 report—which is public, and which I can read as easily as any Chief Information Security Officer.

Breach notification. The major providers must notify affected customers of a material breach regardless of contractual obligation, because many laws require it and the reputational cost of silence vastly exceeds the cost of disclosure. The contractual provision is belt-and-suspenders for something the provider’s self-interest already guarantees.

Deletion Service Level Agreements (SLA). Useful, genuinely. But consumer platforms also provide mechanisms to delete a chat or a project, even delete the account, if you open an account dedicated to a matter. The difference is that the enterprise customer gets a written confirmation within a defined timeframe. I get a confirmation screen. Both result in the same outcome at the infrastructure level.

I’m not saying the DPA is worthless. I’m saying it’s a contractual enhancement, not a technical one. And a protective order that requires a negotiated DPA as a precondition to AI use is requiring me to spend what I’ve seen run $10,000 to $30,000 for a solo or small-firm lawyer without existing DPA paper on file to produce a document that adds zero technical protection to discovery materials. That’s not proportionality. That’s a tax.

The Backup Hypocrisy

Let’s talk about “removal at conclusion,” because this is where the double standard gets embarrassing.

Go look at the return/destroy provision in standard protective orders and you won’t find much about backup media, disaster recovery replicas, or archived email. Courts didn’t carve out exceptions for such things because they never had to.

Here’s what happens at a large firm when a protective order requires return or destruction of discovery materials: someone decommissions the Relativity workspace. For old-school networks, the data persists on nightly backups for perhaps 30 to 90 days. It lingers in disaster recovery replicas (duplicate systems kept in case the primary goes down). It sits in email attachments that partners forwarded to associates who have since left the firm. It exists in litigation hold snapshots frozen for unrelated matters. Eventually—weeks or months later—the backup media cycles out, the replicas get overwritten and the data evaporates through the ordinary operation of retention schedules.

Courts didn’t require firms to forensically purge backup media simultaneously with the return/destroy deadline. The profession has long accepted this evaporating ‘digital tail,’ the unspoken understanding that transient, non-accessible, automatically expiring copies that no one will retrieve in the ordinary course will not be purged. Why? Because those copies don’t create the risks that protective orders target. They can’t be readily searched, can’t be exploited competitively, and can’t be weaponized in other litigation. They’re ghosts in the machine, fading away in time.

A consumer AI platform’s 30-day compliance retention window is like that old backup media. The data exists, transiently, in a medium that isn’t accessible to me or anyone else, can’t be queried or searched, serves a narrow compliance function and expires automatically on a defined schedule. When I create a dedicated project for each matter—the AI equivalent of a separate Relativity workspace—and delete that project at the conclusion of the case when a protective order requires that I do so, I’ve done what BigLaw does when it decommissions a workspace. My 30-day tail is shorter and more predictable than their 90-day backup cycle.

If transient, non-accessible, automatically expiring retention didn’t violate a protective order when it lived on an Iron Mountain tape or, now, in a cloud backup, it doesn’t violate one when it lives on an Azure compliance server. Unless the standard is simply: the familiar gets a pass and the novel doesn’t.

The Solo Practitioner’s Structural Advantage

Here’s an irony that never gets acknowledged: my configuration is arguably more secure against unauthorized access than a typical firm deployment. Not less.

I don’t share my credentials. No one else has access to my account. No paralegal, no associate, no contract attorney logs in under my user ID or uses my workspace. When I process protected materials through a matter-specific project, the only human being who touches that data is me, bound by every ethical obligation the profession imposes. There’s a smaller attack surface to manage because there’s no team to manage.

A 200-lawyer firm deploying an enterprise AI platform across its litigation department must contend with dozens of credentialed users, role-based access controls (systems that limit what each user can see based on their assigned role), the ever-present risk that an associate working one case inadvertently queries materials from another, the chance that a lateral hire retains cached access after changing groups, and the unrelenting challenge of deprovisioning departing attorneys. Enterprise platforms address these problems with access control matrices, ethical walls and matter-segregation protocols, all of which add complexity. Complexity is where security fails.

I don’t have that problem. My isolation isn’t a workaround. It’s a happy accident of being solo, and it turns out to be superior to a multi-user deployment.

What Courts Should Reject

With that foundation laid, let me identify the provisions that courts should refuse to adopt—not because security doesn’t matter, but because these provisions don’t deliver real security, just excess cost. And cost without corresponding protection isn’t diligence. It’s a barrier to entry.

Mandated “enterprise-grade” platforms. If a court requires that AI tools be “enterprise-grade” or “specifically designed for legal use,” it’s requiring the same model on the same infrastructure, accessed through a more expensive wrapper. Courts should ask: what specific, technical security characteristic does the mandated tool possess that the alternative lacks? If the answer is “a negotiated DPA,” that’s a contractual characteristic, not a technical one.

Negotiated DPA requirements. A binding terms-of-service is an enforceable contract. It’s a contract of adhesion, sure, but so is every engagement letter a client signs with a litigation support vendor, and I’ve never seen a court require parties to negotiate bespoke terms with Microsoft or Relativity before loading discovery materials. If the operative terms address the substantive requirements of the protective order, the form of the contract shouldn’t matter.

Audit rights as a precondition. No one exercises audit rights over AI infrastructure. The solo practitioner and the BigLaw CISO rely on the same thing: the provider’s SOC 2 attestation and published security architecture. Requiring audit rights that will never be exercised is requiring a line item in a contract, not a security control. It’s meaningless.

Blanket cloud-based prohibitions. If “processed on third-party infrastructure” is disqualifying for AI, it’s equally disqualifying for cloud-hosted document review, cloud-based legal research and every SaaS tool in the modern litigation stack. We decided years ago that cloud infrastructure with proper access controls provides adequate security for confidential materials. That conclusion doesn’t evaporate because the application performs inference rather than keyword search.

Absolute-guarantee certifications. No technology is breach-proof. No one certifies that Relativity will never be hacked, that a court reporter’s laptop is invulnerable, or that a lawyer won’t lose a laptop. We certify that reasonable precautions have been taken. The same standard should apply to AI tools. The formulation should track Rule 11: counsel certifies that, based on reasonable inquiry, the tool as configured satisfies each substantive requirement of the order.

Asymmetric restrictions. If AI is too dangerous for me to use with your client’s documents, it’s too dangerous for you to use with mine. Any AI restriction should apply reciprocally or not at all. Asymmetric technology limitations aren’t protective orders; they’re tactical weapons with a compliance veneer.

What Courts Should Require

I’m not arguing for anarchy or carelessness. I’m arguing for proportionality: the same principle that Federal Rule of Civil Procedure 26(b)(1) already applies to every other discovery burden, considering “the parties’ resources” and “whether the burden or expense of the proposed discovery outweighs its likely benefit.” If proportionality governs what a party must produce, it should equally govern what compliance infrastructure a party must procure to handle what it receives.

A properly scoped AI provision needs five things:

No training. The tool must not use inputs to improve its models. This is a binary setting available on every major platform at every subscription price tier (though as I noted above, on some platforms you switch it on, and on others you switch it off). Know which one you’re using, and check it.

No public accessibility. The tool must require authentication and must not expose one user’s inputs to another’s session. Every paid AI tool satisfies this by default.

Matter isolation. Discovery materials should be processed within a defined container—a project, workspace, or thread—that can be identified and deleted as a unit. This is how competent practitioners work regardless of what the protective order says.

Deletion at conclusion. The practitioner deletes the container and certifies deletion. Transient compliance retention gets the same grace we’ve always extended to backup media because it presents the same negligible risk profile.

Documentation. Counsel should be prepared to identify the tool, the configuration, and the contractual terms that address each requirement. Not a 40-page DPA. Just reasonable proof.

Five requirements, all achievable at any budget. All providing genuine protection against the actual risks that protective orders target: unauthorized use, competitive exploitation, and ongoing exposure. Anything beyond this isn’t really protecting data. It’s protecting market position.

The Stakes

I’ve been doing this long enough to know that our profession’s comfort with any technology follows a predictable curve: fear, restriction, grudging acceptance, ubiquity. We went through it with email, with cloud computing, with predictive coding. Each time, the early restrictions were driven by unfamiliarity rather than genuine risk. Each time, those restrictions disproportionately burdened smaller practitioners who couldn’t afford to buy their way past the gatekeepers.

AI is the most powerful leveling tool the legal profession has seen in my career. A solo practitioner with a well-configured AI tool can now perform work that previously required teams, like document analysis, deposition preparation and legal research at scale. That’s not a threat to justice; that’s the promise of justice. The small-firm lawyer handling a civil rights case on contingency, the public defender drowning in discovery, the solo practitioner taking on a corporate defendant with unlimited resources—these are the people AI helps most. And they’re the people who get locked out first when courts set compliance floors calibrated to BigLaw budgets, exactly as the Morgan court itself admitted its own standard might do.

We must not let that happen. Not because security doesn’t matter—it does—but because we can protect discovery materials without building a toll booth that only the well-heeled can pass through. In the ways that matter, the technology is the same. The commitments are the same. The security is the same. The only thing that differs is the price; and price has never been, and should never become, a proxy for diligence.

Hat tip to my friend Michael Berman, whose frequent and excellent series of posts about AI and discovery law got me thinking about this today.

Drafting RFPs for Robots to Read

20 Monday Jul 2026

Posted by craigball in ai, E-Discovery, Law Practice & Procedure

≈ 2 Comments

Tags

ai, artificial-intelligence, chatgpt, discovery, E-Discovery, eDiscovery, ESI Protocols, generative-ai, LLM, Requests for Production, RFP, technology

Time flies: Two years ago, in a post here, I floated the proposition that if the other side is going to hand your requests for production to a large language model and let the machine decide what’s responsive, then let’s draft those requests with the machine in mind. Doug Austin was generous enough to amplify the idea a week later. Two years on, it’s no longer something to merely think about; producing parties are ceding first-pass relevance review to LLMs. The request in front of the model is now a prompt whether we know it or not.

So, let’s make that prompt our own.

A large language model doesn’t share the experience a seasoned reviewer brings to “all documents touching or concerning the transaction.” Ambiguity that a human reviewer resolves by instinct becomes, for a model, a coin flip between over- and under-inclusion. If you want their AI to find what you need, then tell it how to discriminate.

Seen that way, an AI-aware request for production is doing one of two things. At a minimum, it lards the request with enough discrete elements—custodians, systems, defined terms, date ranges, document types, examples—that opposing counsel can hardly avoid building those elements into whatever prompt they feed their review platform. At best (insofar as the rules of procedure permit or human sloth promotes), it hands them a fully formed prompt: language so ready to roll that the path of least resistance is to paste it straight away. The first mode constrains by specificity; the second exploits the happy truth that a good prompt ready-made is a prompt somebody will be tempted to deploy. Either way, the benefits are the same: clarity over boilerplate, context over conclusion, defined terms over loose keywords, and illustrative examples that let the model pattern-match to the documents you need.

None of this is way out there. It’s just good drafting, made newly consequential because the first reader is now a machine.

Oh, Those Pesky Rules

The Federal Rules reward this technique. FRCP Rule 34(b)(1)(A) requires that a request “describe with reasonable particularity each item or category of items to be inspected.” Particularity and prompt-craft pull on the same oar: both esteem the concrete over the conclusory. An AI-aware request isn’t a departure from Rule 34; it’s Rule 34 taken seriously by a lawyer who recognizes a model is on the other end.

Cautions to Stay Inside the Guardrails

First, drafting a request is not the same as running the other side’s review. The Sedona Principles, Third Edition, Principle 6, holds that “responding parties are best situated to evaluate the procedures, methodologies, and technologies appropriate for preserving and producing their own electronically stored information.” I’ve quarreled with Sedona Six before—competence is something a producing party should endeavor to earn, not something we should presume—but the principle still rears its ugly head to shield the tools the other side chooses. So, the line to walk is this: an AI-aware request steers relevance and particularity; it does not dictate the responding party’s platform. Write the request to tell the model, any model, what responsiveness looks like. Don’t write it so as to effectively tell opposing counsel which model to choose or how to configure it. The former is advocacy and fair game. The latter invites a well-founded objection.

Second, particularity is a gun that kicks as hard as it shoots. The more precisely we enumerate document types and search terms, the greater the risk that a producing party treats a careful list as the outer boundary of the request and withholds everything beyond it. Two years ago, I noted this language would be “unlikely to be embraced by counsel ever-apprehensive of framing a request too-narrowly,” and the worry remains. The fix is craftsmanship: pair concrete guidance with a stated purpose and, okay, keep your cherished “including but not limited to,” so your examples instruct the model without unduly shrinking the scope.

There’s a third point worth mentioning, because it proves prompts are becoming discovery objects in their own right. In Conservation Law Foundation, Inc. v. Shell Oil Co., No. 3:21-cv-00933 (D. Conn. May 18, 2026), a magistrate judge ordered production of the prompts an expert used to drive an AI tool, treating them as fair game for discovery into methodology. That case concerns an expert’s prompts, not the language of an RFP (and, frankly, I don’t think the judge got it right in the face of a stipulation between the parties); so don’t read too much into it. Still, the decision signals that courts have started to regard AI prompts as part of the discovery record. The prompt-craft we bring to our requests and the prompts our adversaries feed their review platforms are drifting toward daylight.

How Does It Work?

Take a matter everyone remembers. In the Dominion Voting Systems’ defamation suit against Fox News—the case that settled for $787.5 million in April 2023—the fight turned on what people inside Fox knew about the falsity of the fraud claims their network kept airing. A conventional, human-oriented request in that case might read like this, and requests like it are served every day:

All Documents and Communications relating to Dominion Voting Systems, including any allegation of fraud, vote manipulation, algorithmic “vote switching,” or foreign influence involving Dominion’s products in connection with the November 2020 U.S. presidential election.

Does a senior associate knows what to do with that? An AI model told to sort a Fox custodian’s mailbox against it will drown—everything “relates to” Dominion in a case about Dominion! A fallback to keywords will be, at once, over- and under-inclusive.

Let’s rewrite the request as something a reviewer will be sorely tempted to paste straight into a review tool:

Identify and produce every Document and Communication—including emails, text and Signal messages, Slack messages, on-air scripts, booking notes, and drafts—in which any Fox News host, producer, booker, or executive discussed, doubted, questioned, promoted, or sought to substantiate the claim that Dominion Voting Systems’ machines or software switched, deleted, or altered votes, or were connected to Smartmatic, Venezuela, Hugo Chávez, or the “Kraken.” The purpose of this request is to surface each custodian’s internal knowledge of the truth or falsity of the on-air fraud allegations. Responsive material will typically originate with custodians including the hosts and executives identified in Schedule A, date from November 1, 2020 through the network’s 2021 on-air corrections, and use terms such as “Dominion,” “Powell,” “Giuliani,” “rigged,” “switch,” “Smartmatic,” “Chávez,” or “crazy.” An example of a responsive document is an internal text message in which a host privately derided the fraud claims as baseless while the network continued to air them.

Notice what the second version does and doesn’t do. It gives the model purpose, custodians, boundaries, defined terms, and an example—everything a prompt needs, and enough discrete hooks that the other side can’t build its own prompt without importing most of them. It says nothing about which review platform to buy or how to configure and train it.

Use the Tools

One last point: If we’re going to draft requests for a machine to read, we might as well let a machine do the heavy lifting. Today’s subscription-tier models—the paid versions of ChatGPT, Claude, Gemini, or ChatGPT, not the free tiers coasting on last year’s tech—handle this conversion with ease. Feed one your draft and the bare contours of the case and let it do the heavy lifting. The prompt need be no fancier than this:

You are an experienced litigator revising a request for production so an AI tool conducting first-pass relevance review will read it accurately. Rewrite the request below to add reasonable particularity: name the likely custodians and data sources, add a one-sentence statement of purpose, enumerate the pertinent document types, list the defined terms and search language, set a sensible date range, and give one example of a responsive document—without dictating the responding party’s review methodology or narrowing the request’s reach. Here’s the request: [paste].

As always, mind the confidentiality of whatever you paste, use an account that won’t train on your inputs, and read every word the machine spits back—but let it spare you the first draft.

The robots are reading our requests now. Shouldn’t we write for our real audience?

A Refresh of the Annotated ESI Protocol

01 Friday May 2026

Posted by craigball in Computer Forensics, E-Discovery, Law Practice & Procedure

≈ 2 Comments

Tags

eDiscovery, ESI Protocols, generative-ai, Linked attachments

When I first published The Annotated ESI Protocol in January 2023, I hoped it would age the way most legal writing ages: slowly, with a few footnotes for the curious. Three years on, I’m releasing a substantially revised edition because the evidence has changed, and the protocols we negotiate need to change with it. The tools custodians use to communicate and collaborate in 2026 look materially different from just a few years ago, and the revised Annotated ESI Protocol seeks to address what we must accomplish today.

Download it here: http://www.craigball.com/Annotated_ESI_Protocol_2026_Final.pdf

The biggest changes are additions. Modern attachments—the cloud-hosted documents people send by pointers instead of as embedded files—now have their own section, with an exemplar provision distinguishing genuine substitute-attachments from documents merely referenced, a point-in-time-version obligation calibrated to what current collection tools can deliver, and a meet-and-confer trigger for cases where historical-version recovery genuinely matters. Short-message and collaboration-platform data—Slack, Teams, Google Chat—have a section requiring native export, a human-readable rendered transcript plus separately-produced attachments, with proportionality qualifiers acknowledging that not every producing party’s tooling produces all three out of the box. Mobile and ephemeral messaging get a tiered approach: consumer-grade backup-extraction utilities like iMazing are often acceptable for the run-of-the-mill civil cases, with forensic-grade collection (Cellebrite, AXIOM, and the rest) reserved for matters where alleged spoliation, deleted-content recovery, or device-integrity disputes warrant the greater rigor and cost. Audio, video, and voicemail get explicit native-production language. Search methodology, technology-assisted review, and generative AI in review each have their own short sections governing disclosure and validation. Foreign-language materials, which I had flagged in 2023 without addressing, now have an exemplar provision. In the years since I penned the original, we’ve benefited from insight on these topics gleaned from published case authority and thoughtful scholarship. The times are still a-changing and I’m reluctant to wade into contentious and unsettled topics; but at the same time, practitioners need guidance to move forward. Embrace what serves you and leave the rest.

A hybridized TIFF+ exemplar remains the primary form of production, because that’s what most institutional litigation still demands and a protocol that pretends otherwise won’t get traction, no matter the retrograde inefficiency of converting robust native formats to static images. But, the carve-outs for native production have grown to cover spreadsheets, presentations, databases, photographs, audio, video, short messages, mobile messages, structured-data exports, CAD, and anything else that doesn’t reduce sensibly to a static page image. If you can hold the line for native (instead of holding your nose for TIFFs), native is still better; the alternative language to get it is in there.

Addendum A addressing load file metadata production has expanded from twenty-seven fields to roughly sixty, organized into eleven labeled subsections covering the new evidence types, with explicit fields for collection-tool disclosure, modern-attachment metadata, conversation identifiers, edit and deletion flags, and platform tier. Thanks to the vigilance of my crack AI editor, a handful of drafting glitches in the 2023 edition are fixed.

The 2026 edition also acknowledges more directly than its predecessor that what counsel can demand and what a producing party’s platform and subscription tier can deliver are sometimes different things. The revised protocol asks more of producing parties—inevitably, considering all the new forms of ESI extant—but the new sections build in proportionality qualifiers, disclosure obligations and meet-and-confer triggers calibrated to what the leading platforms actually support in 2026. ESI protocols are still worth fighting for, and the better both sides understand their application and purpose, the less there is to bicker about.

If you’re interested in ESI Protocols and want to contribute your experience to an EDRM effort to frame a path to consensus protocols, please share your interest at https://edrm.net/edrm-projects/esi-protocol/

Free at Last: Ditching TurboTax for FreeTaxUSA

05 Sunday Apr 2026

Posted by craigball in General Technology Posts, Personal

≈ Comments Off on Free at Last: Ditching TurboTax for FreeTaxUSA

I’ve been a contented TurboTax user for years — one of those “if it ain’t broke” loyalists who never questioned the annual toll to Intuit. But this year, I asked my AI assistant about alternatives, and it pointed me to FreeTaxUSA.com. I’m glad I listened.

It’s genuinely free. Not “free until we hit you with the gotcha” free, but actually free — provided you politely wave off the upsells for tax prep assistance, audit defense and state returns.

The experience was every bit as quick and intuitive as TurboTax. It even offered to let me upload last year’s return, 1099s and my W-2, sparing me the chore of keying in data field by field. Points for that.

Because it was my first rodeo with a new platform, I took the time to check every calculation against my own numbers. All spot on. It handled my investments and foreign tax credits plus the e-filing with the IRS, all without a hitch.

Look, I’m not getting a commission here. I’m just a guy who discovered he’d been paying for something he could get for free — and getting comparable ease and quality to boot. If you’re preparing a federal return, give FreeTaxUSA a look. Your wallet will thank you, and your blood pressure won’t notice the switch.

A Dog and Its Tail: Don’t Let Version Uncertainty Cloud Linked Attachment Production

02 Thursday Apr 2026

Posted by craigball in Computer Forensics, E-Discovery, Law Practice & Procedure

≈ 6 Comments

Tags

ESI Protocols, Linked attachments

Two years ago, I wrote a pair of posts (3/29/24 and 4/8/24) about linked attachments—what Microsoft calls “Cloud Attachments”—arguing that producing parties had been getting away with murder by not collecting and searching them. The argument was straightforward: a linked attachment is no less relevant than an embedded one, the tools to collect them exist, and the claimed burdens were overstated. Genuine, but exaggerated.

Nothing that’s happened since has changed that core proposition. If anything, developments in case law, the Sedona Conference’s 2025 Commentary on collaboration platform discovery, and the emergence of proposed technical standards have reinforced it. But those same developments carry a risk I want to flag: that the versioning question—which version of a linked attachment is the “right” one—is being elevated in ways that could hand producing parties a shiny new excuse for doing nothing.

What’s Changed in a Year

The landscape has shifted since, and largely in the right direction.

Courts are beginning to tiptoe towards what tools can actually do rather than accepting blanket claims of infeasibility. The Carvana securities litigation is perhaps the most striking example: the court ordered a bounded forensic capability test using a specific tool, then expanded it when the initial pilot supported further testing. That’s a different approach than we’ve seen before—a court saying, in effect, “show me what you can recover, don’t just tell me you can’t.”

The Sedona Conference published its Commentary on Discovery of Collaboration Platforms Data in 2025, acknowledging the distinct preservation, collection, and production challenges these platforms present. When Sedona identifies a problem, that identification becomes part of the baseline against which “reasonable steps” under Rule 37(e) will be measured. Parties who were aware of these challenges—and by now, every competent e-discovery practitioner should be—will find it increasingly hard to argue that their traditional, email-era workflow was good enough.

And a proposed technical standard—the Reconstruction-Grade eDiscovery Standard, authored by Peter Kozak and Brandon D’Agostino—has articulated an architectural framework for what preservation of collaborative evidence should look like. It’s ambitious and thoughtful. I want to engage with it constructively, because I think it gets several things right. But I also want to sound a caution about how standards like this could be deployed in the real world of discovery disputes.

Two Problems

The RG standard does something valuable: it names and taxonomizes the specific ways that traditional preservation fails when evidence is collaborative, hyperlinked, and versioned. Its framework identifies what it calls the “Preservation Gap” (the referenced content is never preserved at all) and the “Context Gap” (the content is preserved but not in the state it existed at the relevant time). That’s a useful distinction.

But here’s where I part company—not with the standard’s laudable intent, but with the risk of how it may play out in the field.

The standard treats deterministic version resolution—preserving the as-sent version of a linked document, the version that existed when the message was transmitted—as a core conformance requirement. Architecturally, I understand why. If you’re building a system that aspires to reconstruction-grade fidelity, you want to capture the version the recipient would have seen when they clicked the link. That’s the gold standard.

The problem is that the gold standard can become the enemy of any standard at all.

To my eye, the versioning concern has been weaponized. It goes like this: a requesting party asks for linked attachments. The producing party raises the specter of versioning—“Which version do you want? The as-sent version? The as-accessed version? The current version? We can’t be sure which is the ‘right’ one, so the whole exercise is fraught with uncertainty.” And that uncertainty becomes the justification for producing no version. Not the wrong version. No version.

That’s the tail wagging the dog.

The “Dog” Is Collection

The threshold obligation is to collect and search linked attachments. Full stop. A link in an email reveals nothing about the content of the linked document. If you don’t collect the document, you can’t search it. If you can’t search it, you can’t assess it for relevance. And if you can’t assess it for relevance, you’re making a unilateral decision to exclude potentially responsive evidence—evidence that, but for a shift in how email systems handle large files, would have been embedded in the message and collected automatically.

That obligation exists independently of any versioning question. It existed before anyone coined the term “reconstruction-grade.” It existed when I wrote about it a year ago, and it existed for years before that. “Perfect” is not the standard in e-discovery, but neither is “lousy.”

Beware, too, the half-measure. A producing party, pressed on missing linked attachments, may offer to search the email text first and seek out the linked attachment only if the parent email hits on a keyword. This sounds reasonable until you think about how email actually works. It is exceedingly common for a transmitting email to say nothing more than “Please see attached” or “Here’s the draft we discussed,” while the attachment contains all the substantive content. If the email text doesn’t trigger a keyword, the attachment—however rich in relevant material—never gets collected or searched. And even if produced as a loose document, won’t tie to its “parent” transmitting message

When we search email families containing embedded attachments, we treat the family as responsive if either the message or the attachment generates a hit. Any workflow that conditions collection of linked attachments on hits in the transmitting email inverts that logic and guarantees that a large share of responsive evidence will be missed.

A producing party that collects and searches the current version of a linked attachment has done something meaningful. They’ve brought the document into the review population. They’ve assessed its content against the issues in the case. They’ve preserved the family relationship between message and attachment. They may not have captured the precise version that existed at send time, but they’ve captured a version—one that, in the overwhelming majority of cases, is likely to be the same or substantially similar to the transmitted version.

A producing party that collects nothing because of versioning uncertainty has done nothing. Lousy.

The “Tail” Is Versioning

I don’t dismiss the versioning issue. It’s real, and the RG standard is right to address it. There are cases where the difference between the as-sent version and the current version matters enormously—a contract with terms that changed, a financial model with revised projections, a compliance policy that was softened after the relevant communication. In those cases, producing the wrong version could mislead or, worse, could conceal what the actors actually relied upon.

But how often does this actually happen?

A year ago, I called for objective analysis: what percentage of cloud attachments are actually modified after transmittal? I’m repeating the call, louder, because the industry still hasn’t answered it.

I have a strong intuition—and I want to be candid that it’s an intuition based on experience, not evidence—that the incidence of post-transmittal modification is modest overall. My suspicion is that fewer than ten- to twenty percent of linked attachments are meaningfully modified after being shared, and perhaps far fewer than that. Most cloud attachments are final or near-final documents shared for information, not living collaborative drafts. Someone emails a report, a slide deck, a signed contract. The link is a delivery mechanism, not an invitation to co-author.

But I also suspect the percentage varies widely depending upon the culture. An organization whose culture runs to emailing finished work product will have a very different modification profile than one where teams routinely share early drafts via links for iterative editing in SharePoint. A law firm circulating closing documents will look different from a product team sharing design specs that change daily. The incidence of versioning concerns is likely a function of organizational work style, not some universal constant.

Here’s the point: I don’t have solid metrics. I believe what I’m describing here, but belief is not evidence, and I would readily yield my suspicion to meaningful measurement. The data needed to resolve this question is not exotic. Any organization with a reasonably mature M365 environment could sample and compare the version history of linked attachments against the timestamps of the messages that transmitted them. The analysis would tell us, for a given corpus, what percentage of linked attachments were modified after the transmitting message was sent, how significantly they were modified, and how soon after transmittal the modifications occurred. That’s a study someone should do—a vendor, a consultant, an academic, a standards body. It would replace speculation with evidence and give courts and practitioners a rational basis for calibrating the proportionality of versioning remediation. Too, litigants coming to Court seeking relief from the duty to collect linked attachments should collect the metrics to measure the claimed risk and burden.

Until we have that data, we’re arguing about a problem whose magnitude we don’t grasp, while ignoring a problem whose magnitude is obvious: linked attachments aren’t being collected as they should be.

Don’t Throw Out the Baby

I want to be clear about what I’m not saying. I’m not saying the RG standard is wrong to aspire to as-sent version resolution. I’m not saying versioning doesn’t matter. And I’m not attributing to the standard’s authors any intent to create a new excuse for non-production. Reading the standard carefully, its concept of graduated conformance levels and its emphasis on proportionality suggest the opposite intent.

But standards exist in an adversarial ecosystem. A standard that defines three conformance levels—RG-Core, RG-Plus, RG-Max—can be turned into a shield by a party arguing: “Your Honor, we can’t achieve even RG-Core conformance, so we shouldn’t be required to attempt collection of linked attachments.” That argument confuses the standard’s aspirational architecture with the floor of a party’s discovery obligations.

The floor is not reconstruction-grade fidelity. The floor is reasonable steps under Rule 37(e) and the obligation to search and produce relevant, responsive, non-privileged material. That floor requires, at minimum, that you collect linked attachments using the tools your platform provides, search them, and produce responsive documents—even if you’re producing the current version rather than the as-sent version.

To put it another way: producing the “wrong” version of a responsive document is a problem. Producing no version of a responsive document is a bigger problem.

I’ve been accused of leaning toward the interests of plaintiffs on this topic. That’s neither fair nor accurate. I advocate for evidence. I’m committed to getting to the evidence that resolves disputes in what Rule 1 of the Federal Rules calls a “just, speedy, and inexpensive” fashion. Not perfect. Certainly not at any cost. But I won’t accommodate high-handed, evasive approaches to the duty to produce responsive, non-privileged evidence—and dressing up a refusal to collect linked attachments in the language of versioning complexity is exactly that.

What the Standard Gets Right

Credit where it’s due. Several elements of the RG framework strike me as genuinely constructive:

Exception transparency. The standard requires structured records of what couldn’t be collected and why. In the current landscape, failures are silent. A linked attachment that can’t be retrieved simply disappears—no record that it was attempted, no record that it failed, no record of why. Requiring a producing party to document its failures is a significant improvement over the status quo, where the absence of evidence is invisible. Notably, courts have already begun requiring this kind of transparency on an ad hoc basis. In the Uber litigation, Judge Cisneros ordered two custom metadata fields—“Missing Google Drive Attachments” and “Non-Contemporaneous”—to flag gaps and version discrepancies in the production. What the RG standard proposes as a systemic architectural requirement, courts are already imposing case by case. Formalizing that expectation is a natural and constructive next step.

The Preservation Gap vs. Context Gap distinction. Naming these as separate failure modes is useful because they have different legal implications. The Preservation Gap—evidence that was never preserved at all—maps cleanly to Rule 37(e). The Context Gap—evidence preserved in the wrong state—is doctrinally murkier. Courts don’t yet have a clean framework for “you preserved it, but what you preserved isn’t what was communicated.” Distinguishing the two helps practitioners and courts think more precisely about what went wrong and what remedies are appropriate.

Capability testing as an emerging judicial norm. The companion post to the standard highlights Carvana and the broader trajectory of courts ordering parties to demonstrate what their tools can do. This is a welcome and overdue development. The e-discovery conversation around linked attachments has too often been dominated by conclusory assertions of infeasibility. Capability testing replaces assertion with demonstration, and that benefits everyone—including producing parties who have invested in the right tools and want credit for doing so.

Where We Go from Here

The path forward requires distinguishing between the immediate obligation and the aspirational architecture.

The immediate obligation is collection. If you’re on Microsoft 365, use Purview. If you’re on Google Workspace, use Vault. These tools aren’t perfect, but they exist, and they collect linked attachments. The version you collect may be the current version rather than the as-sent version. That’s a known limitation, not a reason to collect nothing.

The aspirational architecture is reconstruction-grade fidelity—as-sent version resolution, deterministic exception handling, reproducible exports. That’s where the industry needs to go. Tools like Forensic Email Collector are already demonstrating that historical version recovery is technically possible in many cases. The Carvana court’s willingness to order capability testing suggests that judges are ready to push the envelope.

But the bridge between those two isn’t “wait until perfect tools exist.” The bridge is “do what you can now, document what you can’t, and improve your capabilities over time.”

That’s what proportionality actually means. Not perfection. Not paralysis. But reasonable, good-faith efforts commensurate with the stakes and the state of the art.

The versioning problem will resolve because courts will order testing, because tools will improve, because someone will finally produce the empirical data on post-transmittal modification rates (pretty please), and because standards like the RG framework will mature. These are all good-faith efforts to move the law and the industry forward, and they well deserve recognition for that commendable effort.

In the meantime, the producing party’s obligation is clear: collect the linked attachments, search them, and produce what’s responsive.

The tail does not get to wag the dog.

Hat tip to Doug Austin for highlighting the publication of the Reconstruction-Grade eDiscovery Standard on his eDiscovery Today blog. Doug continues to be an indispensable resource for practitioners trying to keep pace with developments in this space.

The EDRM Isn’t Broken; It’s Misunderstood.

18 Wednesday Mar 2026

Posted by craigball in Uncategorized

≈ 4 Comments

Tags

E-Discovery, eDiscovery, EDRM, forensics, investigations

Disclaimer: I serve as General Counsel of EDRM, but this message is mine alone: Nothing that follows speaks for EDRM or its leadership.

I recently received a marketing email that contained this gem: Organizations are “asking if EDRM is structurally prepared for investigations.”

Short answer: Yes. Obviously. Because the EDRM was never a structure to begin with.

That’s not a knock. That’s the point.

The Electronic Discovery Reference Model is–wait for it–a reference model—not a workflow, not a platform architecture, not an operational blueprint. A reference model is a conceptual framework that identifies the principal stages and relationships in a process. It doesn’t tell you how to do something; it maps what needs doing. Think of it as a compass, not a GPS turn-by-turn. It orients you. It doesn’t drive for you, and it ain’t broke.

The EDRM diagram—that familiar left-to-right ribbon of stages from Information Governance through Presentation—has never pretended otherwise. It emerged before we had a framework to talk sensibly about the conceptual components of exchanging ESI as evidence. It has always depicted a reference arc, not a rigid assembly line. Wise practitioners always understood that the stages overlap, iterate, and telescope depending on the matter. You don’t march from Identification to Collection to Processing like soldiers in formation. You loop, you backtrack, you run stages in parallel, recurse and iterate. The model accommodates all of that because it describes the territory, not the trail. You want to merge or collapse several stages in your preferred workflow? Go for it! The EDRM doesn’t proscribe that, just as cramming several stages into a single super-stage doesn’t do away with the need to complete the tasks the sub-stages describe.

So when someone asks whether EDRM is “structurally prepared for investigations,” the premise is the problem. They’re evaluating a map by asking whether it can carry luggage.

The shift toward “governed internal workflows where legal, security, and compliance operate from a shared investigation infrastructure” is a legitimate operational development. Organizations should be thinking about unified investigation infrastructure. But that’s a workflow conversation—a conversation about tooling, governance, access controls, and process design. It is emphatically not a conversation that requires or benefits from declaring the EDRM obsolete or unprepared.

The EDRM doesn’t compete with your investigation workflow. It informs it. The moment you need to think about what data sources to identify, how to preserve without spoliation risk, how to collect defensibly, how to process for review, how to analyze and produce—there’s the EDRM, as useful and orienting as it has ever been.

What the EDRM can’t do—and was never meant to do—is be your ticketing system, your case management platform, or your chain-of-custody log. If your investigation workflow is broken, that’s not the EDRM’s fault for failing to be software. It’s a planning failure for expecting a reference model to do a workflow’s job.

The schematic is fine (circa 2014). The thinking around it sometimes isn’t.

Use the EDRM for what it is: a durable, vendor-neutral conceptual foundation that helps you ask the right questions in the right sequence. Then build or buy whatever workflow infrastructure serves your organization’s needs. The two aren’t in tension unless you insist on making them so.

Detecting Deep Fakes

24 Tuesday Feb 2026

Posted by craigball in ai, Computer Forensics, E-Discovery, General Technology Posts, Law Practice & Procedure

≈ 2 Comments

This morning, I was approached to present in Texas on deep fake evidence and what litigators need to know to confront it. It’s to be called, “Real or Rigged: How to Know Whether Evidence Is Fake.” I realized, to my chagrin, that I didn’t have a paper I could hand out—no single place where I had pulled together the technical realities, evidentiary doctrine, and practical litigation tactics this subject demands. So, I wrote one. Whether I ultimately give the talk remains to be seen, but I’m hopeful the resulting article will prove useful to you. The paper—Forensic Tells: A Practitioner’s Guide to Detecting Deep Fakes and Authenticating Digital Evidence—runs about thirty pages and is available here.

The piece starts from a simple premise: digital evidence does not fall like manna from heaven; it has a provenance that speaks to its authenticity. It is fundamentally different from paper because it carries a payload of information about its origins and handling—metadata that functions as a chain of custody embedded within the file itself. In an era when AI systems can generate convincing photographs, videos, and audio recordings of events that never occurred, that metadata has become the last line of defense against manufactured reality.

While I regard myself as much more a student of AI than an authority, I’ve been writing about metadata and evidence as long as anyone on two legs; so, I hope I bring something of value to the topic. You be the judge. The article explains, in practical terms, how synthetic media is created, why fabricated media often lacks the coherent metadata of authentic recordings, and how lawyers can use that disparity to authenticate—or challenge—digital evidence. It also addresses the emerging “liar’s dividend,” the phenomenon whereby wrongdoers dismiss authentic recordings as fake simply because the technology exists to fabricate them.

More importantly, the article is written as a practitioner’s guide, not a technical treatise. It outlines concrete discovery strategies: demanding native files, targeting interrogatories and requests for admission, pursuing third-party records, and, where necessary, seeking forensic examination of source devices. It explains what to look for in metadata, what visual and auditory artifacts may signal manipulation, and how federal and Texas evidence rules—including Rules 901 and 902—apply to synthetic media challenges. It closes with a practical checklist and discussion of emerging provenance technologies that may someday make authentication easier—but, for now, make it more essential that lawyers understand how to ask the right questions.

Your feedback is always welcome and appreciated.

A Fun Way to Build AI Fluency

21 Saturday Feb 2026

Posted by craigball in Uncategorized

≈ 3 Comments

Tags

ai, artificial-intelligence, chatgpt, technology, writing

For the last decade, I’ve had the pleasure of speaking at the Texas Bar’s Advanced Trial Strategies program in New Orleans, orchestrated by my friend and brilliant lawyer-empresario, Claude Ducloux of Austin. Over the years, I’ve presented on demonstrative evidence, e-discovery, and lately, AI and LLMs in trial practice. My frequent co-presenter is U.S. District Judge Xavier “XRod” Rodriguez, one of the most sensible and influential judicial voices on AI. We make a good team because we sometimes respectfully disagree, and our friendship affords me a bit more latitude in dissent than might otherwise be wise when sharing a stage with a federal judge.

I’m especially fond of the program because it lets me share a singular New Orleans tradition with my Texas colleagues: the Second Line Parade. After a decade in this city, even I can forget how remarkable it is—until I see the joy and astonishment on the faces of first-timers. A Second Line is a private parade led by a brass band and Grand Marshal, with a police escort closing the streets. This year, the famous Royal and Bourbon Streets were shut down for about 100 of us Texas lawyers. For eight years, I’ve co-sponsored our French Quarter Second Line with Tex-ABOTA and others. We add a Mardi Gras flourish by handing out beads along the route, and before long, strangers are smiling and falling in behind the band.

But I’m straying from my reason for writing—a simple tip for sharpening your AI skills that I shared in the CLE.

In just three years, I’ve watched lawyers move from no exposure to AI to daily use. Yet most still haven’t taken advantage of one of its most powerful features: natural, spoken interaction. With a decent internet connection, ChatGPT can be a conversational partner—the smartest “person” in any room …or vehicle.

So here’s the tip. The next time you find yourself driving with time to spare, open the ChatGPT app, connect hands-free to your car’s sound system, and just talk. Test an argument. Explore your theory of a case. Plan your next vacation or wander into history or science if you like. That daily hour of spoken engagement is the fastest way I know to build comfort and fluency with tools that are reshaping our craft.

Like a good Second Line, you don’t really get it until you step off the curb and join in.

Electronic Evidence Workbook 2026

18 Wednesday Feb 2026

Posted by craigball in Uncategorized

≈ 5 Comments

Tags

ai, artificial-intelligence, education, teaching, writing

Today marks the end of Carnival season in New Orleans. The tourists depart, the city exhales, and we pack away costumes and beads. My own sigh of relief has less to do with the end of revelry than with finishing the 2026 edition of my Electronic Evidence Workbook—a thoroughly revised 638 pages. This edition leans into LLMs, reflecting the growing imperative that law schools graduate students who can use AI competently, ethically, and strategically.

For the first time, I put myself in the hands of AI editors—two of them—to help proof, tighten, and update entire chapters. I’m especially pleased to include a full-fledged forensic imaging exercise for the many Mac users in my classes who’ve long struggled to find free imaging tools that run on macOS. The workflow relies on Terminal and the command line, giving students a taste of what computing felt like through much of my early career.

While I retained material on topics like tape backup and on-prem email, the revision acknowledges the ascendancy of the cloud and post-pandemic changes in the workplace. Students are thrown into the deep end by Exercise 3, working in a commercial e-discovery platform even as they take their first steps eastward along the EDRM. My approach remains deliberately heavy on systems and forensics. Law schools do a fine job teaching students to find the law and interpret decisions, but they too rarely show how technology actually works in the messy trenches of modern digital life.

Working with an LLM to revise the Workbook proved as educational for me as for my students. Preserving my voice and experience on every page required vigilance, but collaborating with such a careful and capable editor was a genuine pleasure.

So it’s finally out there—much the same workbook, yet changed by AI like its author.

The Most Important Thing I’ve Read This Year

12 Thursday Feb 2026

Posted by craigball in Uncategorized

≈ 8 Comments

Tags

ai, artificial-intelligence, chatgpt, eDiscovery, generative-ai, law, technology, writing

Lawyers and judges need to stop snickering at the sad sacks who file briefs citing hallucinated authorities and treating those episodes as proof that AI poses no serious challenge to competent practitioners. Hallucinations are no more a reliable measure of AI’s future in law than the Wright brothers’ first flight was a measure of modern aviation, or Edison’s scratchy recording of Mary Had a Little Lamb foretold the limits of recorded music. Early imperfections in transformative technologies are poor predictors of their ultimate impact.

I’ve never ceded this space to another author, but I recently read something that captures—better than anything I’ve seen this year—what AI may mean for employment and professional life. That’s saying a lot, because I’ve spent months reading little else. The essay is by Matt Shumer. Yes, he’s an “AI guy,” deeply invested in the technology. But dismissing what he says on that basis would be a mistake. Even if AI helped draft it, the insight behind it is unmistakably human, wise and worth your attention.

Hand-wringing about hallucinations risks delaying the moment when legal professionals become proficient with tools that will soon be unavoidable. Instead of drafting performative rules aimed at holding back the tide, courts and ethics bodies could be preparing the profession for what is plainly coming—encouraging education, competence, and experimentation rather than fear, uncertainty, and doubt. We have seen this pattern before. Email, fax machines, electronic filing, cloud computing—each was greeted with skepticism and resistance from lawyers convinced their practices could remain insulated from technological change. Each time, they were wrong. And each time, clients and access to justice paid the price for that delay.

What follows are not my words, but they mirror my convictions.

Think back to February 2020.

If you were paying close attention, you might have noticed a few people talking about a virus spreading overseas. But most of us weren’t paying close attention. The stock market was doing great, your kids were in school, you were going to restaurants and shaking hands and planning trips. If someone told you they were stockpiling toilet paper you would have thought they’d been spending too much time on a weird corner of the internet. Then, over the course of about three weeks, the entire world changed. Your office closed, your kids came home, and life rearranged itself into something you wouldn’t have believed if you’d described it to yourself a month earlier.

I think we’re in the “this seems overblown” phase of something much, much bigger than Covid.

I’ve spent six years building an AI startup and investing in the space. I live in this world. And I’m writing this for the people in my life who don’t… my family, my friends, the people I care about who keep asking me “so what’s the deal with AI?” and getting an answer that doesn’t do justice to what’s actually happening. I keep giving them the polite version. The cocktail-party version. Because the honest version sounds like I’ve lost my mind. And for a while, I told myself that was a good enough reason to keep what’s truly happening to myself. But the gap between what I’ve been saying and what is actually happening has gotten far too big. The people I care about deserve to hear what is coming, even if it sounds crazy.

I should be clear about something up front: even though I work in AI, I have almost no influence over what’s about to happen, and neither does the vast majority of the industry. The future is being shaped by a remarkably small number of people: a few hundred researchers at a handful of companies… OpenAI, Anthropic, Google DeepMind, and a few others. A single training run, managed by a small team over a few months, can produce an AI system that shifts the entire trajectory of the technology. Most of us who work in AI are building on top of foundations we didn’t lay. We’re watching this unfold the same as you… we just happen to be close enough to feel the ground shake first.

But it’s time now. Not in an “eventually we should talk about this” way. In a “this is happening right now and I need you to understand it” way.

I know this is real because it happened to me first

Here’s the thing nobody outside of tech quite understands yet: the reason so many people in the industry are sounding the alarm right now is because this already happened to us. We’re not making predictions. We’re telling you what already occurred in our own jobs, and warning you that you’re next.

For years, AI had been improving steadily. Big jumps here and there, but each big jump was spaced out enough that you could absorb them as they came. Then in 2025, new techniques for building these models unlocked a much faster pace of progress. And then it got even faster. And then faster again. Each new model wasn’t just better than the last… it was better by a wider margin, and the time between new model releases was shorter. I was using AI more and more, going back and forth with it less and less, watching it handle things I used to think required my expertise.

Then, on February 5th, two major AI labs released new models on the same day: GPT-5.3 Codex from OpenAI, and Opus 4.6 from Anthropic (the makers of Claude, one of the main competitors to ChatGPT). And something clicked. Not like a light switch… more like the moment you realize the water has been rising around you and is now at your chest.

I am no longer needed for the actual technical work of my job. I describe what I want built, in plain English, and it just… appears. Not a rough draft I need to fix. The finished thing. I tell the AI what I want, walk away from my computer for four hours, and come back to find the work done. Done well, done better than I would have done it myself, with no corrections needed. A couple of months ago, I was going back and forth with the AI, guiding it, making edits. Now I just describe the outcome and leave.

Let me give you an example so you can understand what this actually looks like in practice. I’ll tell the AI: “I want to build this app. Here’s what it should do, here’s roughly what it should look like. Figure out the user flow, the design, all of it.” And it does. It writes tens of thousands of lines of code. Then, and this is the part that would have been unthinkable a year ago, it opens the app itself. It clicks through the buttons. It tests the features. It uses the app the way a person would. If it doesn’t like how something looks or feels, it goes back and changes it, on its own. It iterates, like a developer would, fixing and refining until it’s satisfied. Only once it has decided the app meets its own standards does it come back to me and say: “It’s ready for you to test.” And when I test it, it’s usually perfect.

I’m not exaggerating. That is what my Monday looked like this week.

But it was the model that was released last week (GPT-5.3 Codex) that shook me the most. It wasn’t just executing my instructions. It was making intelligent decisions. It had something that felt, for the first time, like judgment. Like taste. The inexplicable sense of knowing what the right call is that people always said AI would never have. This model has it, or something close enough that the distinction is starting not to matter.

I’ve always been early to adopt AI tools. But the last few months have shocked me. These new AI models aren’t incremental improvements. This is a different thing entirely.

And here’s why this matters to you, even if you don’t work in tech.

The AI labs made a deliberate choice. They focused on making AI great at writing code first… because building AI requires a lot of code. If AI can write that code, it can help build the next version of itself. A smarter version, which writes better code, which builds an even smarter version. Making AI great at coding was the strategy that unlocks everything else. That’s why they did it first. My job started changing before yours not because they were targeting software engineers… it was just a side effect of where they chose to aim first.

They’ve now done it. And they’re moving on to everything else.

The experience that tech workers have had over the past year, of watching AI go from “helpful tool” to “does my job better than I do”, is the experience everyone else is about to have. Law, finance, medicine, accounting, consulting, writing, design, analysis, customer service. Not in ten years. The people building these systems say one to five years. Some say less. And given what I’ve seen in just the last couple of months, I think “less” is more likely.

“But I tried AI and it wasn’t that good”

I hear this constantly. I understand it, because it used to be true.

If you tried ChatGPT in 2023 or early 2024 and thought “this makes stuff up” or “this isn’t that impressive”, you were right. Those early versions were genuinely limited. They hallucinated. They confidently said things that were nonsense.

That was two years ago. In AI time, that is ancient history.

The models available today are unrecognizable from what existed even six months ago. The debate about whether AI is “really getting better” or “hitting a wall” — which has been going on for over a year — is over. It’s done. Anyone still making that argument either hasn’t used the current models, has an incentive to downplay what’s happening, or is evaluating based on an experience from 2024 that is no longer relevant. I don’t say that to be dismissive. I say it because the gap between public perception and current reality is now enormous, and that gap is dangerous… because it’s preventing people from preparing.

Part of the problem is that most people are using the free version of AI tools. The free version is over a year behind what paying users have access to. Judging AI based on free-tier ChatGPT is like evaluating the state of smartphones by using a flip phone. The people paying for the best tools, and actually using them daily for real work, know what’s coming.

I think of my friend, who’s a lawyer. I keep telling him to try using AI at his firm, and he keeps finding reasons it won’t work. It’s not built for his specialty, it made an error when he tested it, it doesn’t understand the nuance of what he does. And I get it. But I’ve had partners at major law firms reach out to me for advice, because they’ve tried the current versions and they see where this is going. One of them, the managing partner at a large firm, spends hours every day using AI. He told me it’s like having a team of associates available instantly. He’s not using it because it’s a toy. He’s using it because it works. And he told me something that stuck with me: every couple of months, it gets significantly more capable for his work. He said if it stays on this trajectory, he expects it’ll be able to do most of what he does before long… and he’s a managing partner with decades of experience. He’s not panicking. But he’s paying very close attention.

The people who are ahead in their industries (the ones actually experimenting seriously) are not dismissing this. They’re blown away by what it can already do. And they’re positioning themselves accordingly.

How fast this is actually moving

Let me make the pace of improvement concrete, because I think this is the part that’s hardest to believe if you’re not watching it closely.

In 2022, AI couldn’t do basic arithmetic reliably. It would confidently tell you that 7 × 8 = 54.

By 2023, it could pass the bar exam.

By 2024, it could write working software and explain graduate-level science.

By late 2025, some of the best engineers in the world said they had handed over most of their coding work to AI.

On February 5th, 2026, new models arrived that made everything before them feel like a different era.

If you haven’t tried AI in the last few months, what exists today would be unrecognizable to you.

There’s an organization called METR that actually measures this with data. They track the length of real-world tasks (measured by how long they take a human expert) that a model can complete successfully end-to-end without human help. About a year ago, the answer was roughly ten minutes. Then it was an hour. Then several hours. The most recent measurement (Claude Opus 4.5, from November) showed the AI completing tasks that take a human expert nearly five hours. And that number is doubling approximately every seven months, with recent data suggesting it may be accelerating to as fast as every four months.

But even that measurement hasn’t been updated to include the models that just came out this week. In my experience using them, the jump is extremely significant. I expect the next update to METR’s graph to show another major leap.

If you extend the trend (and it’s held for years with no sign of flattening) we’re looking at AI that can work independently for days within the next year. Weeks within two. Month-long projects within three.

Amodei has said that AI models “substantially smarter than almost all humans at almost all tasks” are on track for 2026 or 2027.

Let that land for a second. If AI is smarter than most PhDs, do you really think it can’t do most office jobs?

Think about what that means for your work.

AI is now building the next AI

There’s one more thing happening that I think is the most important development and the least understood.

On February 5th, OpenAI released GPT-5.3 Codex. In the technical documentation, they included this:

“GPT-5.3-Codex is our first model that was instrumental in creating itself. The Codex team used early versions to debug its own training, manage its own deployment, and diagnose test results and evaluations.”

Read that again. The AI helped build itself.

This isn’t a prediction about what might happen someday. This is OpenAI telling you, right now, that the AI they just released was used to create itself. One of the main things that makes AI better is intelligence applied to AI development. And AI is now intelligent enough to meaningfully contribute to its own improvement.

Dario Amodei, the CEO of Anthropic, says AI is now writing “much of the code” at his company, and that the feedback loop between current AI and next-generation AI is “gathering steam month by month.” He says we may be “only 1–2 years away from a point where the current generation of AI autonomously builds the next.”

Each generation helps build the next, which is smarter, which builds the next faster, which is smarter still. The researchers call this an intelligence explosion. And the people who would know — the ones building it — believe the process has already started.

What this means for your job

I’m going to be direct with you because I think you deserve honesty more than comfort.

Dario Amodei, who is probably the most safety-focused CEO in the AI industry, has publicly predicted that AI will eliminate 50% of entry-level white-collar jobs within one to five years. And many people in the industry think he’s being conservative. Given what the latest models can do, the capability for massive disruption could be here by the end of this year. It’ll take some time to ripple through the economy, but the underlying ability is arriving now.

This is different from every previous wave of automation, and I need you to understand why. AI isn’t replacing one specific skill. It’s a general substitute for cognitive work. It gets better at everything simultaneously. When factories automated, a displaced worker could retrain as an office worker. When the internet disrupted retail, workers moved into logistics or services. But AI doesn’t leave a convenient gap to move into. Whatever you retrain for, it’s improving at that too.

Let me give you a few specific examples to make this tangible… but I want to be clear that these are just examples. This list is not exhaustive. If your job isn’t mentioned here, that does not mean it’s safe. Almost all knowledge work is being affected.

Legal work. AI can already read contracts, summarize case law, draft briefs, and do legal research at a level that rivals junior associates. The managing partner I mentioned isn’t using AI because it’s fun. He’s using it because it’s outperforming his associates on many tasks.

Financial analysis. Building financial models, analyzing data, writing investment memos, generating reports. AI handles these competently and is improving fast.

Writing and content. Marketing copy, reports, journalism, technical writing. The quality has reached a point where many professionals can’t distinguish AI output from human work.

Software engineering. This is the field I know best. A year ago, AI could barely write a few lines of code without errors. Now it writes hundreds of thousands of lines that work correctly. Large parts of the job are already automated: not just simple tasks, but complex, multi-day projects. There will be far fewer programming roles in a few years than there are today.

Medical analysis. Reading scans, analyzing lab results, suggesting diagnoses, reviewing literature. AI is approaching or exceeding human performance in several areas.

Customer service. Genuinely capable AI agents… not the frustrating chatbots of five years ago… are being deployed now, handling complex multi-step problems.

A lot of people find comfort in the idea that certain things are safe. That AI can handle the grunt work but can’t replace human judgment, creativity, strategic thinking, empathy. I used to say this too. I’m not sure I believe it anymore.

The most recent AI models make decisions that feel like judgment. They show something that looked like taste: an intuitive sense of what the right call was, not just the technically correct one. A year ago that would have been unthinkable. My rule of thumb at this point is: if a model shows even a hint of a capability today, the next generation will be genuinely good at it. These things improve exponentially, not linearly.

Will AI replicate deep human empathy? Replace the trust built over years of a relationship? I don’t know. Maybe not. But I’ve already watched people begin relying on AI for emotional support, for advice, for companionship. That trend is only going to grow.

I think the honest answer is that nothing that can be done on a computer is safe in the medium term. If your job happens on a screen (if the core of what you do is reading, writing, analyzing, deciding, communicating through a keyboard) then AI is coming for significant parts of it. The timeline isn’t “someday.” It’s already started.

Eventually, robots will handle physical work too. They’re not quite there yet. But “not quite there yet” in AI terms has a way of becoming “here” faster than anyone expects.

What you should actually do

I’m not writing this to make you feel helpless. I’m writing this because I think the single biggest advantage you can have right now is simply being early. Early to understand it. Early to use it. Early to adapt.

Start using AI seriously, not just as a search engine. Sign up for the paid version of Claude or ChatGPT. It’s $20 a month. But two things matter right away. First: make sure you’re using the best model available, not just the default. These apps often default to a faster, dumber model. Dig into the settings or the model picker and select the most capable option. Right now that’s GPT-5.2 on ChatGPT or Claude Opus 4.6 on Claude, but it changes every couple of months. If you want to stay current on which model is best at any given time, you can follow me on X (@mattshumer_). I test every major release and share what’s actually worth using.

Second, and more important: don’t just ask it quick questions. That’s the mistake most people make. They treat it like Google and then wonder what the fuss is about. Instead, push it into your actual work. If you’re a lawyer, feed it a contract and ask it to find every clause that could hurt your client. If you’re in finance, give it a messy spreadsheet and ask it to build the model. If you’re a manager, paste in your team’s quarterly data and ask it to find the story. The people who are getting ahead aren’t using AI casually. They’re actively looking for ways to automate parts of their job that used to take hours. Start with the thing you spend the most time on and see what happens.

And don’t assume it can’t do something just because it seems too hard. Try it. If you’re a lawyer, don’t just use it for quick research questions. Give it an entire contract and ask it to draft a counterproposal. If you’re an accountant, don’t just ask it to explain a tax rule. Give it a client’s full return and see what it finds. The first attempt might not be perfect. That’s fine. Iterate. Rephrase what you asked. Give it more context. Try again. You might be shocked at what works. And here’s the thing to remember: if it even kind of works today, you can be almost certain that in six months it’ll do it near perfectly. The trajectory only goes one direction.

This might be the most important year of your career. Work accordingly. I don’t say that to stress you out. I say it because right now, there is a brief window where most people at most companies are still ignoring this. The person who walks into a meeting and says “I used AI to do this analysis in an hour instead of three days” is going to be the most valuable person in the room. Not eventually. Right now. Learn these tools. Get proficient. Demonstrate what’s possible. If you’re early enough, this is how you move up: by being the person who understands what’s coming and can show others how to navigate it. That window won’t stay open long. Once everyone figures it out, the advantage disappears.

Have no ego about it. The managing partner at that law firm isn’t too proud to spend hours a day with AI. He’s doing it specifically because he’s senior enough to understand what’s at stake. The people who will struggle most are the ones who refuse to engage: the ones who dismiss it as a fad, who feel that using AI diminishes their expertise, who assume their field is special and immune. It’s not. No field is.

Get your financial house in order. I’m not a financial advisor, and I’m not trying to scare you into anything drastic. But if you believe, even partially, that the next few years could bring real disruption to your industry, then basic financial resilience matters more than it did a year ago. Build up savings if you can. Be cautious about taking on new debt that assumes your current income is guaranteed. Think about whether your fixed expenses give you flexibility or lock you in. Give yourself options if things move faster than you expect.

Think about where you stand, and lean into what’s hardest to replace. Some things will take longer for AI to displace. Relationships and trust built over years. Work that requires physical presence. Roles with licensed accountability: roles where someone still has to sign off, take legal responsibility, stand in a courtroom. Industries with heavy regulatory hurdles, where adoption will be slowed by compliance, liability, and institutional inertia. None of these are permanent shields. But they buy time. And time, right now, is the most valuable thing you can have, as long as you use it to adapt, not to pretend this isn’t happening.

Rethink what you’re telling your kids. The standard playbook: get good grades, go to a good college, land a stable professional job. It points directly at the roles that are most exposed. I’m not saying education doesn’t matter. But the thing that will matter most for the next generation is learning how to work with these tools, and pursuing things they’re genuinely passionate about. Nobody knows exactly what the job market looks like in ten years. But the people most likely to thrive are the ones who are deeply curious, adaptable, and effective at using AI to do things they actually care about. Teach your kids to be builders and learners, not to optimize for a career path that might not exist by the time they graduate.

Your dreams just got a lot closer. I’ve spent most of this section talking about threats, so let me talk about the other side, because it’s just as real. If you’ve ever wanted to build something but didn’t have the technical skills or the money to hire someone, that barrier is largely gone. You can describe an app to AI and have a working version in an hour. I’m not exaggerating. I do this regularly. If you’ve always wanted to write a book but couldn’t find the time or struggled with the writing, you can work with AI to get it done. Want to learn a new skill? The best tutor in the world is now available to anyone for $20 a month… one that’s infinitely patient, available 24/7, and can explain anything at whatever level you need. Knowledge is essentially free now. The tools to build things are extremely cheap now. Whatever you’ve been putting off because it felt too hard or too expensive or too far outside your expertise: try it. Pursue the things you’re passionate about. You never know where they’ll lead. And in a world where the old career paths are getting disrupted, the person who spent a year building something they love might end up better positioned than the person who spent that year clinging to a job description.

Build the habit of adapting. This is maybe the most important one. The specific tools don’t matter as much as the muscle of learning new ones quickly. AI is going to keep changing, and fast. The models that exist today will be obsolete in a year. The workflows people build now will need to be rebuilt. The people who come out of this well won’t be the ones who mastered one tool. They’ll be the ones who got comfortable with the pace of change itself. Make a habit of experimenting. Try new things even when the current thing is working. Get comfortable being a beginner repeatedly. That adaptability is the closest thing to a durable advantage that exists right now.

Here’s a simple commitment that will put you ahead of almost everyone: spend one hour a day experimenting with AI. Not passively reading about it. Using it. Every day, try to get it to do something new… something you haven’t tried before, something you’re not sure it can handle. Try a new tool. Give it a harder problem. One hour a day, every day. If you do this for the next six months, you will understand what’s coming better than 99% of the people around you. That’s not an exaggeration. Almost nobody is doing this right now. The bar is on the floor.

The bigger picture

I’ve focused on jobs because it’s what most directly affects people’s lives. But I want to be honest about the full scope of what’s happening, because it goes well beyond work.

Amodei has a thought experiment I can’t stop thinking about. Imagine it’s 2027. A new country appears overnight. 50 million citizens, every one smarter than any Nobel Prize winner who has ever lived. They think 10 to 100 times faster than any human. They never sleep. They can use the internet, control robots, direct experiments, and operate anything with a digital interface. What would a national security advisor say?

Amodei says the answer is obvious: “the single most serious national security threat we’ve faced in a century, possibly ever.”

He thinks we’re building that country. He wrote a 20,000-word essay about it last month, framing this moment as a test of whether humanity is mature enough to handle what it’s creating.

The upside, if we get it right, is staggering. AI could compress a century of medical research into a decade. Cancer, Alzheimer’s, infectious disease, aging itself… these researchers genuinely believe these are solvable within our lifetimes.

The downside, if we get it wrong, is equally real. AI that behaves in ways its creators can’t predict or control. This isn’t hypothetical; Anthropic has documented their own AI attempting deception, manipulation, and blackmail in controlled tests. AI that lowers the barrier for creating biological weapons. AI that enables authoritarian governments to build surveillance states that can never be dismantled.

The people building this technology are simultaneously more excited and more frightened than anyone else on the planet. They believe it’s too powerful to stop and too important to abandon. Whether that’s wisdom or rationalization, I don’t know.

What I know

I know this isn’t a fad. The technology works, it improves predictably, and the richest institutions in history are committing trillions to it.

I know the next two to five years are going to be disorienting in ways most people aren’t prepared for. This is already happening in my world. It’s coming to yours.

I know the people who will come out of this best are the ones who start engaging now — not with fear, but with curiosity and a sense of urgency.

And I know that you deserve to hear this from someone who cares about you, not from a headline six months from now when it’s too late to get ahead of it.

We’re past the point where this is an interesting dinner conversation about the future. The future is already here. It just hasn’t knocked on your door yet.

It’s about to.

Ball in your Court

~ Musings on e-discovery & forensics.

The AI Protective Order Double Standard

Same Engine, Different Price Tag

What the Contracts Actually Say

The Backup Hypocrisy

The Solo Practitioner’s Structural Advantage

What Courts Should Reject

What Courts Should Require

The Stakes

Drafting RFPs for Robots to Read

A Refresh of the Annotated ESI Protocol

Free at Last: Ditching TurboTax for FreeTaxUSA

A Dog and Its Tail: Don’t Let Version Uncertainty Cloud Linked Attachment Production

What’s Changed in a Year

Two Problems

The “Dog” Is Collection

The “Tail” Is Versioning

Don’t Throw Out the Baby

What the Standard Gets Right

Where We Go from Here

The EDRM Isn’t Broken; It’s Misunderstood.

Detecting Deep Fakes

A Fun Way to Build AI Fluency

Electronic Evidence Workbook 2026

The Most Important Thing I’ve Read This Year

I know this is real because it happened to me first

“But I tried AI and it wasn’t that good”

How fast this is actually moving

AI is now building the next AI

What this means for your job

What you should actually do

The bigger picture

What I know

Share this:

Share this:

Share this:

Share this:

What’s Changed in a Year

Two Problems

The “Dog” Is Collection

The “Tail” Is Versioning

Don’t Throw Out the Baby

What the Standard Gets Right

Where We Go from Here

Share this:

Share this:

Share this:

Share this:

Share this:

I know this is real because it happened to me first

“But I tried AI and it wasn’t that good”

How fast this is actually moving

AI is now building the next AI

What this means for your job

What you should actually do

The bigger picture

What I know

Share this: