Protective Orders Will Need a Vector-Index Destruction Clause by 2027

The paper copies go back in the box. The derived copies stay on the server until someone can show they are gone.

A matter ends, and someone at the firm signs a certificate saying every copy of the other side's documents has been returned or destroyed. The signature takes a second. If an AI review tool touched those documents, the safer reading is that its embeddings must go too, though none of the orders discussed here uses the word. An embedding is a list of numbers standing in for the meaning of a passage. The tool keeps one for every chunk it cut from an exhibit, filed beside metadata naming the source, page number and document type.

My forecast is narrower. By the end of 2027, AI protective orders will routinely name embeddings and retrieval logs in their return-or-destroy clauses, because no one can check a certificate against vectors that cannot be read. Only an index-level deletion log gives the signature something to rest on.

The worry predates the orders. In February 2025, Amy Swaner, writing on the AI for Lawyers Substack, set out "six critical steps" for a firm to take before deploying generative AI, and the first asked, among other baseline questions, "How is data monitored and disposed of?" She framed it as governance, a firm's private housekeeping. In 2026 the Sixth Circuit, in United States v. Farris, took up attorneys' ethical obligations when using AI, and the housekeeping began to look like duty.

One thing the record does not settle is time. None of the sources gathered here says how long it takes to purge a matter's index and its backups, and I would rather leave that blank than guess.

So the place to start is Colorado, where a court wrote its own AI clause after rejecting both sides' drafts.

What Does the Morgan Clause Require of an AI Tool?

Morgan v. V2X bars Confidential material from any AI platform unless the provider is contractually forbidden to train on it or share it, and must delete it on request.

Before a produced document goes into an AI tool under an order shaped like this one, I would want three things confirmed in writing:

1. The provider is contractually barred from storing or using your inputs to train or improve its model.
2. Disclosure to third parties happens only where essential to deliver the service, and any such third party is bound by obligations just as protective.
3. The contract lets you remove or delete all Confidential information on request, and you keep written documentation of every one of these protections.

On March 30, 2026, a magistrate judge in the District of Colorado faced a situation that had arrived quietly, the way most AI disputes still do. A self-represented plaintiff had used AI to help prepare filings, working from material the plaintiff's former employer had designated Confidential. Both sides proposed language. Magistrate Judge Maritza Dominguez Braswell rejected both and wrote the court's own.

The provision that emerged reads less like a ban than like a procurement checklist. Confidential information may not enter an AI platform unless the provider is contractually prohibited from training on inputs and from disclosing them to third parties, except where disclosure is essential to the service. Then comes the condition that matters most here: the provider must contractually allow removal or deletion of all Confidential information on request. The court also ordered the plaintiff to disclose any AI platform already used with confidential materials.

An analysis published by the AAA-ICDR in September 2026 records the court's own forecast of the cost. The provision "will (at least for now) bar the parties from using most, if not all, mainstream low-to-no-cost AI to process Confidential Information." The court seemed to accept that outcome rather than resolve it.

The common assumption is that AI clauses in protective orders exist to stop model training. Morgan's text complicates that. Training is the first condition; deletion is the last, and the only one tested after the case ends.

Morgan was not alone. King & Spalding counted at least five federal district courts that issued or analyzed protective order provisions restricting generative AI between 2025 and early 2026. In Jeffries v. Harcros Chemicals, the District of Kansas's original order required deletion of all confidential information at the conclusion of the action. United States v. Allen requires deletion from any AI tool when the case ends. About three weeks after Morgan, the ByHeart infant formula MDL barred Protected Material from generative AI tools unless three specified conditions were met.

Set side by side, a comparison of 5 sources shows the same drift, away from general prohibitions and toward operational requirements a vendor either meets or does not. Relevant e-Discovery was built around those requirements: processing runs single-tenant, or inside the client's own AWS account under the client's own keys, with no vendor retention and no model training. The earlier wave of protective orders restricting AI training on produced data asked what a tool would learn. The newer orders ask what it will keep.

Deletion on request sounds simple enough. The harder question, the one none of these orders quite reaches, is what the provider would be deleting, and how anyone would know.

How Many Copies Does an AI Tool Make of One Exhibit?

Several kinds, and a standard destruction certificate names none of them: overlapping text chunks, one embedding per chunk, metadata tying chunks to pages, and records of retrieval.

Consider a single exhibit, an email chain stamped Confidential, as it enters an AI review tool built on retrieval-augmented generation. RAG, as the design is usually called, means the system first searches your documents and then answers from what it found. Robi Kumar Tomar, writing in November 2025, lays out the ingestion pipeline in six steps:

1. Load PDFs, DOCX files, emails, HTML and manuals.
2. Clean the text.
3. Split it into chunks, recommended at 200 to 400 tokens with 30 to 50 tokens of overlap.
4. Generate an embedding for each chunk.
5. Add metadata: source, page number and document type.
6. Store the result in a vector database.

An embedding is a list of numbers standing in for a passage's meaning. A vector database is the store that holds those lists and finds the ones nearest a question. OpenAI's smaller current embedding model produces vectors of 1,536 dimensions; its larger model supports up to 3,072. Other accounts of conventional pipelines describe chunks of 300 to 500 words, held in stores such as Pinecone, Weaviate or pgvector.

What strikes me is how ordinary each step is. Nothing here is exotic, and nothing here was designed with a protective order in mind. Because neighboring chunks share text, a sentence from the email can sit in the chunk store more than once before a single vector is computed. Each of those chunks then receives its own embedding and its own metadata row, the row that quietly records which document and which page it came from.

Then a reviewer asks a question. The tool retrieves the 3 to 5 most relevant chunks and passes them to the model along with the question. If the system keeps a record of what it retrieved, that record holds the email's words again, now paired with the reviewer's line of inquiry.

Count it out. One exhibit may persist as a native file, as extracted text, as several overlapping chunks, as an equal number of embeddings, as a metadata row per chunk, and as fragments inside retrieval records, before anyone has asked about backups.

A return-or-destroy certificate was written for things a person can count: boxes, drives, folders. A commenter on the r/legaltech forum, discussing whether to share a legal vector database, observed that such a database is "only usable with the same embedding model you used to create it." The same commenter argued that the underlying corpus and the chunking strategy were the assets worth sharing, not the vectors themselves.

The remark was offered as a reason not to bother sharing an index. Read from inside a protective order, it describes a verification problem. No one can open a vector store and see whether a given email is still there. Absence cannot be inspected. It can only be reported by the system that did the deleting.

The training question, whether your e-discovery AI trains on your case data, concerns what a model learns. This question concerns what a system keeps, and it leaves the receiving party, at the end of a case, signing a sentence about copies it has no way to see.

What Will Matter Most for AI Protective Orders in the Next 12 to 24 Months?

Proof of deletion will matter more than permission to use AI. Courts are settling which tools may touch discovery; the harder question is showing the derived copies are gone.

I see three movements, each already visible in a 2026 ruling.

The forecast could fail in a quieter way. The AAA-ICDR analysis quoted earlier argues that a provider contract should not be the categorical default, and proposes a functional standard instead: no training on inputs or outputs, a provider post-deletion retention window of no more than thirty days, and a dated record of the configuration and published terms. If courts adopt something like it, orders may name a retention window rather than an index. Its author also notes that many current AI restrictions "began as form paragraphs and orders issued without adversarial testing," which suggests the wording is less settled than it looks.

Even then, I expect the log to survive. A retention window still has to be shown, and a dated configuration record is a deletion log by another name, kept one level up. "A judicial signature gives a term legal force," the same analysis observes. "It does not create a factual record that the parties never presented."

None of the sources gathered here describes a court ordering an index-level deletion log. That is the distance the prediction has to travel. The first order to cross it will probably come from a magistrate judge holding two drafts that both miss the index, and a pen.

What Should a Vector-Index Destruction Clause Say?

Name every derived store, set a deletion deadline, and require an itemized, append-only deletion log tied to content hashes, so the certificate rests on a record rather than a promise.

The fix is drafting, not technology. A clause that reaches derived data needs three elements, and I would propose all three before the first production is loaded:

1. A functional definition of Derived AI Data. Describe what the data does rather than which product holds it: extracted and chunked text, embeddings, vector indexes and their metadata, generated summaries, caches, retrieval and prompt logs, and any backup or snapshot containing them.
2. A trigger and a deadline. Deletion at final disposition, or sooner on the designating party's written request, within a fixed number of days the parties agree.
3. An itemized record. Certification store by store, backed by an index-level deletion log, rather than one sentence covering everything.

Here is the difference in practice.

Before: At the conclusion of this action, the Receiving Party shall return or destroy all Protected Material and certify that no copies remain.

After: Within [number] days after final disposition, or sooner on the Designating Party's written request, the Receiving Party shall delete all Protected Material and all Derived AI Data from every system that processed it, deliver an index-level deletion record identifying each system and store, and certify deletion separately for each store listed.

The first version is true or false only in aggregate. The second can be checked line by line, and that is the whole of its value.

The record itself should carry, at minimum, the fields below.

At Relevant e-Discovery, originals are immutable and content-hashed, audit trails are append-only, and chain of custody is documented. An append-only trail is the natural home for a deletion event, because an entry written there cannot be quietly revised afterward. Our tool's answers already link back to the exact exhibit they came from, and that same source linkage is what lets a deletion log name documents rather than gesture toward them. Where the index runs inside the firm's own cloud account, the log becomes the firm's own record instead of a vendor's letter.

Two figures belong in any vendor's answer: the exact format of the index-level deletion log for a single-tenant or own-account deployment, and the elapsed time to purge a matter's index and its backups at close. Neither figure appears here. Ask for both in writing before the first production loads; once supplied, they show precisely what the certificate will rest on.

Defensibility has always rested on records, the same reason predictive coding isn't the only defensible AI review. We invite buyers to bring a messy collection and a hard question and watch the tool read, code and cite their own evidence. I would add one request at the end of that session: delete the matter, and show me the record.

A firm that asks for this record now will already hold one on the day a court first asks to see it.

Will Deletion Logs Become Standard in AI Protective Orders?

Most likely by the end of 2027. Orders already require deletion from AI tools, and the next demand will be a record proving the deletion happened, index by index.

The enforcement record is thin. A September 2026 analysis published on JD Supra reports that courts "have not directly addressed" whether they will sanction a party for uploading confidential discovery into an unauthorized AI application. In Campbell v. TidalHealth, the magistrate judge deferred. Where courts have punished misuse of protected material, the sums stayed modest: in the Uber MDL, $30,000 against the $168,572 Uber sought. The same author warns that such sanctions "may not adequately remediate harm" from AI disclosures, depending on what was exposed.

I read that thinness less as comfort than as a window. When the law is unsettled and the penalties small, the argument tends to turn on who kept records, and a party holding an itemized deletion log is the only one able to answer, without pausing, the question a court will eventually put to both sides.

Ask your vendor for a sample deletion record now, before the matter that needs one arrives. If what comes back is a single signed line, you have learned something about the index.