Quick Answer
No. A protective order can forbid AI training on case data, but cannot prove the vendor obeyed. Single-tenant processing, where documents never reach a shared model, is protection you can check.
The duty never moves. Under Rule 1.6 it covers everything tied to the matter, not only what was said in confidence, and it stays with the lawyer long after the upload. A clause is a promise. Promises get kept, or broken, in a server room you will never stand in.
Key Points
- In Morgan v. V2X (D. Colo. Mar. 30, 2026), a modified protective order let confidential discovery into AI tools only if the provider met three conditions, including a contractual training bar.
- Oliver Morgan reported in August 2026 that major AI platforms typically keep prompts and outputs for up to 30 days for abuse monitoring, a window no training ban touches.
- The ABA's Business Law Today noted in December 2024 that data which does not exist "simply cannot be misappropriated," the logic behind single-tenant processing with no vendor retention.
The order gets signed in the office. The data goes somewhere else.
Yes, if the savings come from where the data runs, not from a promise about it. Cheap review on a shared model just moves the risk somewhere you cannot see.
Every litigation team wants review to cost less. Fair enough. The trouble starts when cost is the only question asked, and the comparison between eDiscovery platforms stops at price per document, speed and the logo on the login screen. Which company is best for a law firm? I think that depends on a question most comparison pages skip. Where does the data go?
The duty does not shrink to fit the budget. The comment to ABA Model Rule 1.6 says the confidentiality rule covers all information relating to the representation, "whatever its source," and not only what a client said in confidence. All of it. The client's email. The other side's production. The junk folders nobody has opened yet.
A rule can name the duty. A protective order can repeat it. Neither one can perform it. That job falls back on you, again, every time a document leaves the building, and a promise on paper is the only thing standing between it and a model you will never see. Just paper.
This article walks that gap in order. First, why vendors want matter data at all. Then what you can and cannot verify once it leaves, and what one Colorado protective order actually does. Last, what a firm should trust in place of the clause, which starts with a plain question about where the documents physically sit tonight.
Read the AI clause in your next protective order, then ask a plain question: what does it actually do to a vendor's training on case data? It can only forbid it. The order gets signed, the no-training clause goes in, and nobody at the firm can see what happens on the other end of the wire.
That gap is where I keep ending up. The American Bar Association's Formal Opinion 512, released on July 29, 2024, places the duty of confidentiality on lawyers who use generative AI, including protecting client data from unauthorized use and access "both within and outside of a law firm." Outside. That is the word that matters. The duty runs into rooms the lawyer will never enter.
Practitioners read the opinion as a reasonable-efforts standard under Rule 1.6, the confidentiality rule. A contractual no-training clause looks like a reasonable effort. It is still only a promise. It tells the provider not to use the data. So ask the vendor, in writing, what record you would ever be shown if it broke that promise.
And when it goes wrong, the law does not blame the software. It looks for the human who chose it. So the question was never whether the paper says no. It was whether anyone could check.
Three questions this article answers:
- Does a protective order stop AI from training on case data?
- How do I know an AI vendor actually deleted my documents?
- Is single-tenant AI safer than a no-training clause?
Training is one question. Retention is another. The contract usually answers only the first.
Why do AI vendors want your case data so badly?
Case data is going into AI tools because AI review costs cents per document, against dollars per document and roughly $19K per gigabyte manually, and vendors want that data.
Before any matter goes near one of those tools, do three plain things:
- List every vendor that can touch client data, including the ones that never mention AI at all.
- Read each vendor's current terms, not the version you signed, but the version that is live today.
- Send out less. Minimize or anonymize whatever has to leave the firm.
Those steps come from guidance the American Bar Association's Business Law Today published in December 2024 for solo practitioners and boutique firms. Simple steps. Almost too simple. The same piece found that the AI governance strategies of many US law firms "either are still in a nascent stage of conceptualization or early implementation, or don't exist at all."
Why the hurry? Because the data is wanted. In 2024 the ABA reported that demand for legal data, from memos and depositions to contracts and settlements, "is surging amid modest supply." Building legal AI requires training data that includes sensitive, privileged and confidential legal documents, the same kind sitting in your matter folders tonight.
Startups want it. Large tech vendors want it. Cybercriminals and malicious insiders want it too, for their own reasons.
And the terms move. Some vendors rewrite their terms of service with immediate or even retroactive effect to permit training on customer data, then send a quiet notice "concealed inside a monthly newsletter." A newsletter. Nobody reads the newsletter.
The common assumption is that a firm that never adopted generative AI has nothing to fear. Wrong. Firm data can still end up in commercial LLM training through third parties, even when the firm itself uses no GenAI tools at all. A malware scanner can ship a suspicious file to its own cloud for analysis, and nobody at the firm knows. An expert witness pastes a draft into an online grammar checker or Google Translate, and the document can be exposed somewhere you will never see.
So the risk does not wait for you to buy an AI tool. It is already in the pipes. A promise on paper cannot see into those pipes.
Combining 4 sources, the pattern holds: the data is wanted, the doors are many, and the thing guarding most of them is a document.
We took a different line on our own platform and built the guard into the process. That means immutable originals with content hashing, append-only audit trails, documented chain of custody, and a fail-closed privilege gate on production, so the process holds up if opposing counsel challenges it. In our design that defensible spine sits in the same tool as cited Q&A and chronologies, because enterprise platforms give you the first and the new AI entrants give you the second.
Courts have started writing their own rules into protective orders that restrict AI training on produced data. Which brings it back to the paper. The order. The clause. What it holds, and what slips out underneath it.
Can you verify what an AI vendor did with your data?
You can verify what a tool shows you and where it runs. You cannot verify what a vendor's servers quietly kept, copied or learned once your documents arrived.
Here is the tension. It sits in the fine print, where nobody looks until something has already gone wrong.
A no-training clause asks you to believe three things you have no way to see:
- That the model never learned from your documents. There is no receipt for something a system did not do. Nothing shows up. Nothing is supposed to.
- That the data stayed where you think it is. The UK Information Commissioner's Office, assessing one large productivity vendor's assistant, recorded that the customer appoints the vendor to transfer data "to the United States, or to any other country in which the vendor or its subprocessors operate."
- That the contract says what you think it says. One industry contract benchmark, from a single vendor with undisclosed methodology, reports that 44 percent of companies discovered training-data clauses they had not negotiated only after signature.
That number stays with me. Not because anyone lied. Because AI features came in through old renewal paperwork that was never built to ask who may learn from the data.
A practitioner on r/legaltech, from a company that builds client-side anonymization, put the right test as a question: "Where exactly in the data flow does anonymization happen?" If the answer is on the vendor's servers, the raw data traveled there first. The same question works for training. If the promise is kept on their side, your documents already crossed over to their side.
The paperwork is behind, too. A Federal Bar Association CLE program on generative AI in litigation pitches the point directly: a protective order template that predates generative AI leaves prompt logs, training-data flows and tool identity unaddressed. Governance advisers sell the same caution from another angle. Confirm the vendor's settings for logging, training opt-out, subprocessors and data residency. Do not assume them.
So what can a firm actually check? Only what it can see. On our platform every answer links back to the exact exhibit it came from, so an attorney can one-click verify before filing, the structural answer to the sanctions risk Mata v. Avianca made famous. In-account AWS deployment under the firm's own keys works on the same logic. The place the data lives is a place you hold.
The paper keeps shifting under you anyway. It is the same problem behind checking whether your AI review vendor can swap models mid-matter: the contract describes a system you cannot inspect. Which leaves one honest question. Not what the vendor promised. Where the copy is.
Does a Morgan v. V2X clause actually keep discovery off a vendor's servers?
A routine fight over an insurance policy in Colorado produced what practitioners have called possibly the first published protective order on AI. Its test for safe uploads comes down to three contract terms.
Morgan v. V2X, Inc. (D. Colo. Mar. 30, 2026) began as "a routine discovery dispute over an insurance policy," according to an r/legaltech summary. It ended with a modified protective order: confidential discovery may go into an AI tool only if the provider meets three conditions, and the plaintiff had to name the AI platforms it had used.
What the Morgan order asks of an AI provider
- It is contractually barred from training on the data.
- It is contractually barred from sharing the data with third parties, except where needed to deliver the service.
- It must allow deletion on request.
As summarized in an r/legaltech discussion of the order, March 2026.
One litigator in the thread wrote that "every ESI Agreement/Confidentiality Agreement which gets signed into an order in every case I work on has a provision about AI now." Another noted that the conditions already mirror frontier-model enterprise terms. If an ordinary enterprise account meets the order, the order says little about where data goes.
All three conditions assume the vendor holds a copy. We found four ways that copy can be kept, demanded, repurposed or exposed while a no-training clause stays fully in force.
Start with retention. Oliver Morgan, a newsletter writer on enterprise AI with no connection to the case, reported in August 2026 that the major platforms default to "bounded retention": prompts and outputs are "typically kept for up to 30 days for abuse monitoring before deletion." Zero retention exists "as a negotiated exception," with eligibility criteria that "are not fully public." A training ban does not touch that window.
Deletion on request has its own weak spot. During its copyright dispute with The New York Times, OpenAI was ordered to keep consumer ChatGPT and API content it would otherwise have deleted, an obligation it says ended on September 26, 2025. In Oliver Morgan's words, a vendor's retention policy "can be overridden by a legal process to which the customer is not a party." Under the CLOUD Act, a provider must preserve or disclose records "within such provider's possession, custody, or control, regardless of whether" they sit inside or outside the United States.
The contract can also change underneath you. A December 2024 article in the American Bar Association's Business Law Today describes vendors that "update their terms with immediate or even retroactive effect" to train on customer data, with notice "concealed inside a monthly newsletter." Oliver Morgan points to a quieter version: a right to use "aggregated and anonymised" customer data for service improvement, placed beneath a headline promise not to train.
Then there is plain failure. In March 2023, OpenAI disclosed that a bug in an open-source library let some ChatGPT users see titles from another active user's chat history and may have exposed payment-related information for 1.2% of ChatGPT Plus subscribers active during a nine-hour window. A commenter affiliated with a contract anonymization company put it plainly: a no-training clause "doesn't stop a breach, a subpoena, or an infrastructure bug from exposing that data."
| Route to your data | What the record shows | Does a no-training clause stop it? | Does it depend on a copy the vendor holds? |
|---|---|---|---|
| Default retention | Typically up to 30 days | No | Yes |
| Preservation order in another case | Content kept until September 2025 | No | Yes |
| CLOUD Act demand | Reaches data wherever stored | No | Yes |
| Rewritten terms or carve-outs | Retroactive changes, aggregated-data rights | Only if the clause survives the change | Yes |
| Breach or bug | Other users' chat titles shown | No | Yes |
Set side by side, the routes share one precondition: each works only on a copy the vendor holds. The Morgan conditions govern what a vendor may do with that copy, and a preservation order in an unrelated lawsuit overrode exactly the kind of deletion promise they rely on. The ABA article names the alternative: "If data does not exist, it simply cannot be misappropriated even in the case of the most sophisticated data breach or flagrant human error." The same reasoning supports single-tenant processing, or processing inside a firm's own cloud account, with no vendor retention. We build our software that way, so weigh our view accordingly. Because the CLOUD Act also covers remote computing providers, the same questions apply to whoever hosts that account.
- Keep a written list of every AI platform that touches confidential discovery. The Morgan plaintiff had to name theirs.
- Ask each vendor how long prompts, uploads and outputs are kept by default, and get any zero-retention commitment and its eligibility terms in writing.
- Ask what happens to your matter data if a preservation order in another case, or a government demand, reaches the vendor, and whether your deletion requests will still be honored.
- Search the data processing terms for service-improvement rights over aggregated or anonymised data and for unilateral rights to change terms. The ABA article recommends a clause making your agreement prevail over any clickwrap terms.
- Ask the question the clause never answers: does any copy of the case data sit on the vendor's side, and who hosts the account where it is processed?
How we checked this
We used two practitioner discussions on r/legaltech, a newsletter analysis of enterprise AI data terms, an ABA Business Law Today article, the text of the CLOUD Act provision, and two disclosures OpenAI published about its own systems. None of the figures here are ours. We have not read the Morgan order itself. Its terms come from a forum summary, and the practitioner comments describe individual experience. OpenAI's accounts describe its own conduct. We sell AI discovery software that runs single-tenant or inside a client's own cloud account with no retention, so we have a commercial stake in this argument. Still unknown: how often preservation orders or government demands actually reach legal AI vendors' customer data, and whether other courts will adopt the Morgan conditions.
- r/legaltech, discussion of the Morgan v. V2X protective order, March 31, 2026.
- r/legaltech, thread on AI and client confidentiality, February 27, 2026.
- Oliver Morgan, The Data Layer newsletter essay, August 17, 2026.
- American Bar Association, Business Law Today, article on protecting law firm data from generative AI, December 9, 2024.
- Legal Information Institute, text of 18 U.S.C. § 2713, retrieved October 19, 2026.
- OpenAI, statement on New York Times data demands, June 5, 2025, updated October 22, 2025.
- OpenAI, report on the March 20 ChatGPT outage, March 24, 2023.
What should a firm trust instead of the clause?
Trust what you can inspect. Processing should run single-tenant, or inside your own AWS account under your own keys, with no vendor retention and no model training at all.
Single-tenant means your matter runs on infrastructure no other customer shares. In-account deployment means the system lives inside your own cloud account, locked with keys you hold. Either way, nothing you feed it trains anyone's model or waives privilege.
Here is the difference, said plainly. A clause is a sentence about what a vendor will not do. Architecture is a fact about where the data can go. One you read and hope. The other you can check.
The law is already leaning toward the second one. Adnan Masood, surveying the legal futures of AI agents in October 2025, wrote that "no legal system allows an 'AI-only' excuse," and that when an AI breaks the law the focus turns to the humans who designed, deployed, or failed to control it. His piece also notes that judges may look to standards such as the NIST AI Risk Management Framework or ISO 42001 to gauge what counts as reasonable practice, and he argues that systems "law-abiding by design and auditable" will be key.
So the weight comes back to the people who chose the tool. Back to you. The question stops being what the vendor promised. It becomes what you deployed, and whether you could ever see inside it.
Data-security vendors now pitch monitoring of how sensitive data flows into and out of AI applications as a minimum. Fair enough. But monitoring is a camera on the door. It tells you the data left. It does not keep the data home.
We built Relevant e-Discovery for the place where this hurts most: the solo or small firm on a single messy matter, the segment Relativity and Everlaw price out and can't serve without an administrator. Enterprise-grade defensibility at small-matter economics. That was the point. A small firm will never audit a vendor's servers. It can own the account the work runs in.
And it can ask harder questions of every platform it tests. Ask, on each one, whether privileged ESI gets embedded before the screen ever runs. Ask where the copy sits tonight. Who holds the key. Whether anyone would tell you if that changed while you slept, or whether you would just find out later, somewhere, from someone else's motion.
What happens when every protective order has an AI clause?
The clause becomes the floor, not the protection. Once every order carries one, it proves nothing, and the firms that can show where their data physically sits will stand apart.
That day is close. One litigator says every ESI or confidentiality agreement signed into an order in their cases now carries an AI provision. Same words. Every time.
Back in 2023, a guest on the Crazy Wisdom podcast predicted that regulated fields like law would adopt large language models more slowly, and rightly so, and that the tools would be judged on whether they could be trusted. That held. What nobody quite said then is that trust, here, is not a feeling. It is a location.
My advice is plain. Sign the order. Keep the clause. Then put the documents somewhere the clause never has to be believed, because a promise you cannot check is still just a promise, sitting in a file, waiting.
Summarize This Article With AI
Open this article in your preferred AI engine for an instant summary.
Frequently Asked Questions
What else do people ask about protective orders and AI training?
Most questions come back to one point: a clause controls what a vendor may do, while architecture controls what a vendor can do. The answers below follow from that.
Does a protective order stop AI from training on case data?
No. A protective order binds the parties, and it can require that any AI provider be contractually barred from training on the data. It cannot see inside the provider. Unless the data never reaches a shared model, compliance is something you take on trust.
What is a no-training clause?
A no-training clause is a contract term that bars an AI provider from using your data to train or improve its models. It governs permission. It does not govern storage, logs, or who else can compel the provider to hand data over.
Can an old software contract allow AI training on my firm's data?
It might. Oliver Morgan notes industry reporting that platform agreements signed before AI features existed may already authorize training on historical customer data under general service-improvement language. He calls it "a risk to check rather than an established fact." Check it anyway. Tonight, if you can.
Who is responsible if an AI tool mishandles case data?
The lawyer who chose it. No legal system treats the software as the responsible party, so the focus lands on whoever deployed it or failed to control it. That is why the deployment decision matters more than the marketing page.
How should a firm paper its vendor relationships?
Keep a written agreement with every outside party that can touch firm data, and make it expressly prohibit unauthorized use. The agreement should carry a conspicuous clause saying it prevails over any clickwrap or terms of service the vendor publishes. Otherwise the vendor's next quiet update can outrank you.
Can a client lose privilege by using an AI tool on their own?
Yes, and it has happened. In US v. Bradley Heppner, the judge held that documents a client generated using AI tools to share with counsel were not privileged. Warn clients early, before they paste the facts of the case into a consumer chatbot at midnight.
Does single-tenant deployment satisfy an AI protective order?
The order asks for contractual bars, and you still need the contract language it names. Architecture makes those bars easy to keep, because there is no shared model to train and no vendor copy to delete.
A digression, because it nags at me. Single-tenant or in-account deployment hands part of the burden back to you: your account, your keys, your configuration. That is the price of being able to check. I think it is worth paying, but it is still a price.
What does Relevant e-Discovery cost, and how do I see it work?
AI-assisted review on the platform runs cents per document rather than the dollars per document of manual review, and the difference shows on your own matter. Book a session through the contact page at relevantediscovery.com/contact-us and bring a real collection. Bring the hard question too, the one you have been putting off.
Written by
Michael
Kansky
Michael Kansky is a serial software entrepreneur who has spent more than two decades building and bootstrapping profitable SaaS and services companies.
Connect on LinkedInRead next
EdiscoveryDesigning a Privilege Gate So Privileged ESI Never Reaches Review
Keep privileged documents out of the review set by screening at ingestion and holding every unscreened file by default. Clawbacks and Rule 502(d) orders only limit damage after a leak.October 19, 202623 min read
EdiscoveryDoes AI Document Review Work on Foreign-Language ESI?
Yes, but only for files that were OCR'd and language-tagged before embedding. Untagged or image-only foreign documents drop out of AI-coded results silently, with no error to warn you.October 18, 202622 min read
Ediscovery