On Tech Ethics Podcast – Use of AI in Legal Discovery

To easily navigate through our podcast, simply click on the ☰ icon on the player. This will take you straight to the chapter timestamps, allowing you to jump to specific segments and enjoy the parts you’re most interested in.

1. Introduction and welcome to guest Mary Kathryn Curry (00:00:03) Host introduces the episode, the guest’s background, and a disclaimer that the discussion is educational and not legal advice.
2. Mary Kathryn’s background and how AI is affecting employment law (00:01:02) Mary Kathryn shares her path from law clerk to employment attorney and why AI has become part of her practice.
3. What legal discovery is and why AI-generated communications matter (00:02:22) She explains the discovery process and why AI-generated communications reveal intent and are increasingly relevant in litigation.
4. The Musk v. Altman trial and AI prompts as discoverable evidence (00:04:57) Mary Kathryn describes how the Musk v. Altman trial raised awareness that stored AI prompts can be subpoenaed and produced.
5. AI chats and attorney-client privilege (00:06:36) She discusses when AI chats may or may not be protected by privilege, citing a case where a CEO’s AI research was ruled discoverable.
6. Consumer-facing AI versus enterprise AI (00:08:30) Mary Kathryn contrasts consumer AI tools, which carry no confidentiality commitment, with governed enterprise AI systems.
7. AI use policies, human validation, and employee training (00:10:40) She stresses the need for AI use policies that require human validation, limit data inputs, and are backed by employee training.
8. Server data retention and litigation holds (00:13:13) The discussion covers how long AI data may be stored on servers and why litigation notice triggers a duty to preserve it.
9. Monitoring employee AI use and a real-world client example (00:15:00) Mary Kathryn explains why employers struggle to monitor AI use and shares a client example of a memo that was not privileged.
10. Five practical steps to reduce legal and discovery risk (00:18:00) She outlines five steps: inventory tools, rank them, assess them before launch, set vendor and contract controls, and monitor regularly.
11. Retention periods and deleting AI data (00:23:02) Mary Kathryn responds to whether companies should delete AI data, noting retention is both a legal and business decision.
12. Looking ahead: courts, regulators, and state AI laws (00:23:55) She predicts more AI-specific discovery requests, preservation and proportionality disputes, privilege battles, and expanding state and federal regulation.
13. Closing remarks and tech ethics training solution (00:28:42) The host closes the episode, promotes CITI Program’s tech ethics training solution, and thanks the production team.

Daniel Smith: Welcome to On Tech Ethics with CITI program. Today, my colleague Andra Popa and I are going to speak with Mary Kathryn Curry, who is an experienced labor and employment attorney at Honigman. Her practice focuses on labor and employment counseling and compliance, working directly with client human resources teams. She supports her clients in all matters relating to the workforce and has served as in-house legal counsel to clients in both technology and healthcare settings. In our conversation, we are going to discuss the use of AI in legal discovery process. Before we get started, I want to quickly note that this podcast is for educational purposes only. It is not designed to provide legal advice or legal guidance. You should consult with your organization’s attorneys if you have questions or concerns about the relevant laws, regulations, and guidance that may be discussed in this podcast. In addition, the views expressed in this podcast are solely those of our guest. And on that note, welcome to the podcast, Mary.

Mary Kathryn Curry: Thank you so much. Happy to be here.

Daniel Smith: It’s great to have you. I very briefly introduced you, but can you start by telling us more about yourself and how AI is affecting the areas that your practice focuses on?

Mary Kathryn Curry: Yes, I can. So my legal career has a somewhat unusual path. Before I joined private practice, I spent 10 years as a law clerk in both state and federal court, so I’ve spent a lot of time around litigation. I transitioned to representing clients directly in private practice in 2015, and specifically I focus on employment law, as you said. I help companies essentially remain compliant with their employee practices. I help them to make decisions with respect to their employees and to ensure they’re following the law. I also conduct investigations, and the goal is always to keep the businesses and organizations that I represent from being sued. However, of course, if they do get sued, I assist with employment related litigation as well. So how that intertwines with AI, as you can imagine, a huge population of your employees at this point are using AI in some form or another. And so that has really had to become a part of my practice as well because businesses are now faced with how do we use it? How do we monitor it? How do we implement it in what we do day-to-day and how do we train our employees on it? So that is everything that I do as well.

Daniel Smith: As I mentioned, we’re going to talk about the use of AI in the legal discovery process. So as level setting for our audience, can you briefly explain what legal discovery is and then also why AI-generated communications have become such an important issue in litigation?

Mary Kathryn Curry: Sure. So legal discovery is that formal pretrial process where parties exchange information on their case, a plaintiff will request evidence from a defendant and vice versa to support their claims and defenses. So discovery is what you need to prove your case or defend your case. Examples in discovery might be requests for information. You may have heard the term interrogatories where you’re asking for somebody to explain something. And then of course, depositions where an individual is under oath answering questions. Discovery used to be in the olden days banker boxes of paper documents. Of course, that’s not really what it is anymore. Now it’s pretty much only electronic documents, emails, files that you’re transferring to the opposing side electronically. And because now we pretty much save everything in electronic format, discovery ends up being a lot of information even if you have a fairly small case.

And then you asked also about AI generated communication. What is it? Why is it so important in this context? Well, that is now becoming a normal part of litigation, and that’s because, as you can imagine, AI-assisted communications show us a lot about what someone has thought, what they’ve considered, what they’ve done, what they’re doing. AI communications can show you what somebody knew, what someone wanted to know, how they asked a question, not just the question itself. It can really reveal someone’s intentions and what they were relying on with respect to a topic or subject, and that often can be pivotal in a lawsuit. It’s different from a Google search where we were just inputting questions and a list of articles, hitting on keywords would come up. Now you input a question and you’re getting an entire analysis, and so it can just do so much more for you. And the question of whether you get the discovery is really no different now than it was before. The relevant question in a discovery dispute is going to be not whether AI was used, but whether that information was relevant, whether it’s not privileged, and whether it’s proportional to a case.

A lot of people, at least in my world, have thought about the well-publicized 2026 trial between Elon Musk and Sam Altman as a start to this conversation about use of private information in litigation, even though that’s not new in and of itself, and even though the Musk versus Altman case is not in and of itself using AI chats, but that trial really got this conversation going about private workplace text messages, diary entries, Slack logs that were used in that case, how those come into litigation and making us more aware of the fact that, oh, all these AI prompts that we’re using are also going to come into litigation. And so legal experts were really starting that warning to say, “Hey, under the rules of legal discovery, any and all text communications, including questions you may type into your AI chat, that’s going to become part of a legal case.” So that’s the message from an employment lawyer’s perspective that I use often with my clients. If you use ChatGPT, if you use Claude, if you use your enterprise system, whether to ask a legal question or research your work-related questions, those prompts are stored on servers. So those prompts can be subpoenaed and can be produced in litigation.

And so even in an employment litigation context, as an example where you might have somebody in your organization who admits to using AI to make some employment related decision, we have to know that, okay, those AI chats that they used may come out in whatever litigation follows.

Andra Popa: Mary, you’ve talked about how these can be used to show intent or state of mind to prove elements of a case, but can these transcripts also break the attorney-client privilege in some way if they analyze their case through any of these systems?

Mary Kathryn Curry: That’s a great question because privilege is a big conversation we’re having right now about using AI chats, and there are cases that have fallen on both sides of that because this has already been a litigated issue. But you can think of it in the same way you would think of a privileged question before AI existed. The same analysis really applies in that if your lawyer has told you, “Hey, I need you to provide me information on X, Y, and Z,” and you use your AI chat tool to help you summarize that for your lawyer, your lawyer’s going to argue, “Hey, that’s privileged. That’s work product. I asked my client to do that.”

But there’s a really well-known case where it wasn’t exactly that factual scenario. Where the CEO said, “You know what? I know I’m going to have to talk to my lawyer in an hour or tomorrow. I’m going to go and just get some intel from my AI chat tool so I’m prepared for the conversation I’m going to have with my lawyer” and typed in all these questions about the case and about the allegations. And then in the lawsuit, when the lawyer tried to argue, “Hey, that’s all privileged because that was about the case,” the judge said, “No, it’s not. That was not at the direction of counsel. That was not because counsel was having you answer questions and trying to learn information from you, and you were just using that as your tool to gather that information.” It was completely separate. So the answer to that question really depends on the facts and what exactly happened. But as noted, we have seen that come out both ways from the court so far.

Daniel Smith: So Mary, another thing that you mentioned previously was the use of enterprise AI, and obviously there’s a lot of discussion around the use of consumer public-facing AIs and enterprise AIs. I’m interested in hearing more from a legal and discovery perspective if there’s differences between the use of the consumer-facing AI that might be considered public and the enterprise-managed AI solution.

Mary Kathryn Curry: Yes, very different. A public or consumer-facing AI tool is what most all of us know about. It’s available to anyone. It’s designed for individual use, the ChatGPT, the Cloud, the perplexity apps that you have on your phones. When you’re using that consumer tool, you’re accepting standard online terms of use to talk about the legal perspective of it. Those terms are likely permitting your information to be retained, reviewed, your prompts and outputs are used to improve their services or their models and to probably further train their models, to be honest. And there’s really no confidentiality commitment to what you’re putting into that. Now, the enterprise tool is designed to be quite distinct in that way because it’s designed to operate within an organization. It’s not a standalone personal product. Enterprise tools offer stronger data segregation, they offer control, they log who’s using the tool, what it’s being used for, and it’s very specifically designed to protect confidentiality through legal contractual terms.

With those contractual terms, the organization is going to build in that security, the administration, the data governance controls. So as a general rule, a public tool is fine for non-confidential information. It’s very helpful, but enterprise AI is a governed business system, and so it’s going to offer that controlled environment that can consider confidentiality, limit access, and generally it’s not going to train models on your prompts. So there is a big difference, privacy and security being a huge part of that.

Daniel Smith: And in terms of governance, in addition to having enterprise solutions where you can build in that confidentiality, are there other things that organizations should think about when employees are regularly using AI tools to generate work products or have it answer questions, anything of the like?

Mary Kathryn Curry: Yes. And I think some of your other podcast guests have talked about this because it’s applicable everywhere. And the short answer is you have to have a policy. Everyone needs to have an AI use policy. And so businesses, universities, not-for-profits, government, it’s applicable to all. And really what you need to be considering in those AI use policies is ensuring that you’ve drafted into those policies that there has to be human validation. So in the employment context, and what I speak to a lot is employees have to be required to review, fact-check, and approve any content that they receive or use from an AI tool. So that requires training because as it becomes more and more common to use these tools and you’re speeding through your workday, realistically, it is easy to just type in what you need and take it and go. And you’re not really stopping to think about what did that output tell me? Why did it tell me that output? What was it considering when it provided me whatever information it did? And then you’re always, as an organization, going to want to limit what data can be input into your AI tools. So you need to be specific about what employees can and cannot put into that AI tool.

And certainly when you’re talking about, for example, hospital systems, you got PHI, you’ve got a lot of confidential information that you need to be aware of and consider who has access to it, how are they using it, are they putting it into these tools? And of course, some AI tools are designed for those kinds of confidential documents very specifically, but not all. And you certainly don’t want those types of documents going into the wrong tool if they’re not supposed to be there. So depending on the tool and the contractual agreements that the organization has in place with whatever enterprise model they have, those are things that really need to be considered in a policy. And then you need to train your employees on that policy because a policy is worth almost nothing if you haven’t gone through each and every aspect of that policy with your employees to say, “This is what this means. This is what you can and cannot do.”

Andra Popa: I had a follow-up question. You mentioned that this data is stored on servers, and for listeners that aren’t familiar, there can be a wide range of time periods that things are stored on servers. There’s not necessarily a record retention policy for servers. It could be infinite, correct?

Mary Kathryn Curry: Yes, is the short answer. And from a legal context, you’re going to start to see the retention policy issue come up more and more, and it’s going to be litigated, but it’s also going to be legislated because retention of this kind of data is already in certain places required. But to your point, depending on the organization and the server and whatever contractual terms you have, it’s different for every organization and different by state even. But I will say from a legal perspective, as soon as an organization knows that there’s a legal issue or they’re on notice that there might be a lawsuit, no matter what their retention policy is, they would be required to retain information. So as soon as they are made aware of potential litigation, that rule that applies now, it applied five years ago, that all information that’s related to that potential litigation must be retained, that would apply then to any AI conversations that may be stored on a server somewhere that may relate to whatever that litigation is.

Alexa McClellan: I hope you’re enjoying this episode of On Tech Ethics. If you’re interested in hearing conversations about the research industry, join me, Alexa McClellan, for CITI’s other podcast called On Research with CITI Program. You can subscribe wherever you listen to podcasts. Now, back to the episode.

Andra Popa: And just to follow up, do employers now also need to track these systems in terms of perhaps employees are seeking advice on employment matters with their actual employer on their actual computers that were assigned to them? Do employers need to monitor that use as well?

Mary Kathryn Curry: The reality is it’s very hard for large employers to know what each and every employee is typing into their AI tool, and they may have many tools. And so unfortunately, how this usually plays out is they find out that an employee is typing in those types of questions that they would rather not have their employee typing in once litigation begins. And I’ll give you an example of something that just happened with a client. The client came to me after this particular business leader was doing research for a program that they were implementing and they were in charge of, and so they were using their enterprise AI tool to help them draft the memo that was going to go out to everybody about it. And so they were trying to figure out how do we set this up? How do we pay people for this particular program that we want to put in place? By the time I got it and by the time their legal team got it had created this memo that included information that from a legal perspective, we’d rather not have it include. It was talking about different options and risks of paying people or not paying people in this memo.

But at this point, that memo was shared with some other business leaders who were working on the project, and we can’t argue that that’s privileged. Nobody from legal asked for that to be created. And then once legal sees it, we say, “Well, that’s not great. That wouldn’t be legal advice we would provide.” And so we have to backtrack at that point. Before AI chat was even an option, that employee probably would’ve come to legal to say, “Hey, how do I structure this so that we’re properly setting this up according to the state law and federal law on how we have to do this?” But they were trying to do their homework and they were trying to get it summarized before they had to go to legal. So there are downsides to this, and you can’t necessarily stop everyone from having these conversations.

Again, this goes into your policy, this goes into your trainings to say, stop yourself before you type in certain subject matter. If you think it might be a legal question, don’t type it in. But again, that’s really going to require training because that is not something that I think your average employee is always thinking about. They’re not thinking about, “Hey, if I ask this question, that question could really be problematic for us down the road,” because they’re just asking a question. They’re just trying to get information and find out what direction they might need to go or if they even need to call legal counsel. So that’s an example of how it can work in the wrong direction, not because somebody is trying to do so.

Daniel Smith: I think it’s really interesting because AI is becoming so ubiquitous. It’s in pretty much everything now, whether you’re using AI like Claude or ChatGPT or Copilot or whatever, but it’s also embedded within all other sorts of software products and people are being encouraged more and more to use it for different things but at the same time, there are these risks that pop up. So going back to the importance of having a policy and governance, if you could distill it down into a few practical steps that organizations can take to reduce legal compliance and discovery risks while still enabling employees to benefit from the AI tools that they have available to them, what would those steps be?

Mary Kathryn Curry: Let me just tell you five steps that before you implement AI with your workforce, here’s what you need to be thinking about. And this goes back to your policy. So it’s tied into that same question and the conversation that we were having earlier. You’re going to want to create an inventory, identify all the tools you’re using, who are your vendors, what features are turned off and what features are turned on, because that’s another issue I’ve run into with clients where they didn’t even know a certain feature was turned on and being used by a certain business segment. And so you have to have a source of truth for everything that you have so that you can address compliance issues. You need to know who your users will be, what data can be input or not input, always considering whether the tools could be used to inform or affect an employment decision.

At least in my world, that’s what I’m focused on because if it can or if it might, then we need heightened review of that because those are going to be the tools that are likely to implicate some sort of legal concern, maybe even state law because we’re seeing a lot of state law move in this direction where we’re actually going to be legislating what employers can and can’t do with respect to their AI tools and what they need to provide as far as information notice and transparency to their employee population or their applicants. And then ranking your tools. So you have this inventory of tools, you need to rank your tools to ensure that if it needs more significant review, a particular tool, that we’ve done that. And if it’s a tool that’s just for scheduling or drafting assistance, maybe we need a little bit less oversight on that because it’s a fairly basic support tool.

And then of course, assessing your tools before they launch, you should know the business purpose of that tool. Do you have security protections in place? Do you have privacy protections in place? Do you need them? Because what is being input into that tool? Determine what notices or consent is required because the law is changing on this and it’s changing state by state. Your lawyer really needs to tell you, “Hey, if you’re using this in Illinois, we actually are required to provide some transparency on this. We have to have a notice posted that we’re even using this tool. We have to tell every applicant that you actually have a tool that lets them chat with our AI chatbot about various job postings that are out there.” And sometimes states require more information to be provided. In New York, you have to do a bias audit. So in assessing your tools, it’s doing a legal assessment too. So don’t try to do this on your own. Make sure you’re involving legal along the way. Make sure you have vendor and contract controls. You should know and understand the tools you’re using. There can be a lot of information in that contract, and if you don’t have somebody who’s really skilled at looking at what specific provisions you’ve agreed to, what they mean, that can be a problem.

So you have to confirm what Andra’s question was earlier, confirm what your retention period is, what is the deletion criteria, what logs can be generated or are generated, and then of course the bias and validation support. You need to know what does the vendor do for you and what do you have to do separately to validate that particular tool. And ongoing monitoring. AI tools are not going to remain static. You’ll need to continually understand the updates. How are they changing? What updates have been added that you may or may not know about? How do those work? If performance or outputs have shifted, you need to be aware of that. And bias is going to be a constant concern for a lot of these because whatever the input is and how it’s being used, sometimes the outputs aren’t going to be what we want and there can be legal ramifications depending on what those are. So employers need to be aware of where it may be showing up in which tools and what they need to do about it. So I would say those five steps, creating the inventory, ranking your tools, assessing your tools, vendor and contract controls and regular monitoring are the top hits for what you need to be thinking about.

Andra Popa: In one of those steps, you talked about the servers again, and are you advocating for more control over servers where you can delete the materials to reduce liability in terms of a corporate setting?

Mary Kathryn Curry: Well, Andra, can I plead the fifth on that? I’m not going to say that you want to, from your lawyers, say, “Yes, make sure you have a very short retention period if you can’t legally so that you just don’t run into trouble.” I think that a lot of that’s going to depend on what can you do, not just, “Hey, this would be ideal for our business,” but legally, what are we required to do? And so there’s going to be retention rules that you have to consider, but that’s not to say that you keep everything forever because we’re talking about a lot of information. And so that question kind of plays into a business decision plus legal decision, I would say, cost and what you have to do.

Daniel Smith: So Mary, we’ve covered a lot of ground today, and I think that your practical steps that you provided are very helpful to leave people with some good guidance on how they can approach this. But to round out our conversation, you started off by talking about how the Altman and Musk cases somewhat set a precedent in the field, even though it wasn’t necessarily related to AI-generated communications. So looking forward, how do you expect the courts and regulators and organizations to adapt to the growing use of AI-generated communications? And then beyond our conversation today, do you have any additional resources that you would recommend for our listeners where they can learn more about anything that we’ve talked about today?

Mary Kathryn Curry: Well, I think you’re already seeing it. What we’re already seeing is going to keep happening. AI communications are creating this entirely new category of discoverable evidence. So conversations, prompts, instructions, drafts, all of that can end up in litigation. And so helping people remember, “Hey, this is not private. It matters more because we’re inputting so much more data and information into these tools.” AI conversations are already becoming routine discovery targets, and they remain subject to those same discovery rules. So if it’s relevant and proportional, it’s going to get pulled in. So I would say that is just important to keep in mind. I can give four developments that I might expect. One, I would say, is AI-specific discovery requests will continue to increase. So I mentioned that preservation I think will be, to Andra’s questions, an increasing topic.

Are companies preserving AI conversations? Will the law continue to change on that? I do expect that it will because we’re going to want people to preserve this information because it’s going to be very relevant to lawsuits, and there’s going to be proportionality battles. That’s not new to discovery, but it’s going to evolve because whether collecting everyone’s AI inputs is really proportional. We’ve had these same questions in litigation now where, “Hey, this case is about employee X, not about all these other employees on the team. Do you really need everyone’s emails or just this person’s emails?” But now we don’t just have emails, which is still a lot of data. Now we have all these AI tool prompts and conversations that we have to factor in.

So we just have a lot more information that is likely to be the fight. And then finally, to Andra’s earlier question, the privilege dispute, because courts are going to have to distinguish between communications that involved counsel and legal advice from the ordinary business use of AI, which we know is discoverable. So just because it involved an attorney, it’s not necessarily going to be considered privilege, and that’s going to be an ongoing debate and dispute in litigation. Was that attorney really asking a question of that particular individual? Was it at their direction? Was it work product? Or were they just using AI as they would otherwise use AI? In which case, hey, all that gets to come into the litigation.

So you asked about regulations too. I think we can expect more from regulators, the EEOC, the Department of Labor, the FTC, all of those government entities are going to be looking, or already are, I should say, looking at this topic, and some state laws have already been put in place. We have Illinois, Texas, Colorado, New York, California, of course, with laws that talk about, from the employment perspective, what organizations need to do and transparency being a big one, providing notice that AI is being used and why, and tracking who reviews the output and how ultimate decisions are reached, that’s going to be part of the regulations that are going to increase. But government, as we know, works slower than the technology advances, so that’s just going to be over time.

And then we talked about the privilege issue and how people need to think about that. So we can expect more conversation about that to try to let employees know, don’t assume you think this is a little private conversation that you’re having because it’s legal related that it won’t come up. And that’s a hard concept for a lot of people. It’s a hard concept for lawyers, so I can expect that that dispute will continue for sure.

Daniel Smith: Well I think that’s a great place to leave our conversation for today. So thank you again, Mary.

Mary Kathryn Curry: Thank you very much. It was great to be here.

Daniel Smith: If you enjoyed today’s conversation, I encourage you to check out CITI program’s other podcasts, courses, and webinars. As technology evolves, so does the need for professionals who understand the ethical responsibilities of its development and use. That is why we developed our new Tech Ethics training solution. This new offering brings together practical, thoughtfully designed courses to help professionals navigate ethical and regulatory challenges with confidence. The courses cover responsible AI, software as a medical device and clinical decision support systems, big data and data science, data management, software development, and more. Check out the link in this episode’s description to learn more.

And I just want to give a last special thanks to our line producer, Evelyn Fornell, and production and distribution support provided by Raymond Longaray and Megan Stuart. And with that, I look forward to bringing you all more conversations on all things tech ethics.