Editor’s Note: Artificial intelligence has reshaped the volume and variety of information enterprises must govern, from Copilot output and Microsoft 365 content to AI-conversation logs, prompts, summaries, and synthetic documents. On June 18, the Electronic Discovery Reference Model announced expanded 2026 guidance and user documentation for IGRM v4.1, framing the Information Governance Reference Model for AI, privacy, risk management, and cross-functional governance. The guidance names seven stakeholder roles that must share a common language and codifies a perpetual policy-process cycle for aligning policy, implementation, review, and improvement across the information lifecycle.

For cybersecurity, data privacy, regulatory compliance, and eDiscovery professionals, the timing matters: AI-generated and AI-assisted content may trigger retention, privacy, security, and discovery obligations depending on its content, business use, jurisdiction, and governing policies. EDRM also signaled that IGRM v4.1 will help anchor the coming EDRM 2.0 revision, making the guidance a useful preview of how the field is modernizing its core reference models for AI-era data.

Watch for adoption in governance charters, training programs, and defensible-disposition workflows as organizations work to keep policy and practice aligned with the data they now create.


Content Assessment: EDRM expands IGRM v4.1 guidance for AI-era information governance

Information - 94%
Insight - 91%
Relevance - 94%
Objectivity - 90%
Authority - 92%

92%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "EDRM expands IGRM v4.1 guidance for AI-era information governance."


Industry News – eDiscovery Beat

EDRM expands IGRM v4.1 guidance for AI-era information governance

ComplexDiscovery Staff

Somewhere in most enterprises right now, an AI assistant is generating transcripts, summaries, and draft documents that no retention schedule was written to govern.

On June 18, the Electronic Discovery Reference Model moved to give that problem a vocabulary, announcing expanded IGRM v4.1 guidance and user documentation that frames its Information Governance Reference Model for AI, privacy, risk management, and cross-functional governance.

Copilot transcripts, Microsoft 365 output, and AI-conversation logs increasingly challenge retention models that were not designed for high-volume, conversational, and synthetic data. For information governance, security, and eDiscovery teams, the refreshed guidance offers updated vocabulary for a problem that is no longer theoretical.

EDRM, a standards organization for global best practices in eDiscovery, information governance, and legal technology, calls IGRM v4.1 a comprehensive update for unified governance, according to the organization’s announcement. The release is anchored by a new IGRM 4.1 User Guide and expanded guidance on how stakeholder groups should align policy and process across the information lifecycle, from creation through disposal.

Guidance reframed for the AI era

The IGRM has served as a foundational reference for information governance since EDRM first published it, framing the discipline as a shared responsibility rather than a single department’s burden. The diagram at its center maps the stakeholders who create, manage, and dispose of enterprise information, and the lifecycle that connects them.

What changed in the 2026 guidance is the framing. EDRM tied the 2026 guidance directly to the spread of AI in business decisions and to the growing intersection of information governance and data governance.

“In today’s information-driven world, and with the rapid evolution of AI, information governance is more important than ever before, both to control risks and to take advantage of new opportunities,” said David R. Cohen, CEO of ATJustice and chair of EDRM’s Board of Project Trustees. “The updated IGRM provides a foundational model for teaching and understanding information governance and the critical roles of various organizational stakeholders in this process.”

Seven stakeholders, one shared language

The earlier IGRM grouped information stakeholders into three broad camps: business users, IT, and legal or regulatory. The v4.1 guidance breaks that down further, naming seven stakeholder roles that must coordinate for governance to hold.

Those roles span business unit leaders who create and use information to deliver value, IT personnel responsible for system integrity and availability, security professionals protecting confidentiality, records and information management staff handling retention and disposition, legal counsel managing legal and regulatory risk, risk professionals overseeing compliance and enterprise risk, and privacy professionals managing obligations tied to personal data.

The point of the expansion is shared language. Mary Mack, CEO and chief legal technologist for EDRM, said governance fails when any one group treats it as someone else’s job.

“Information governance is not the sole responsibility of any single department or stakeholder,” Mack said. “Effective governance requires collaboration, shared language, and a commitment to continuous improvement. The IGRM v4.1 provides organizations with a reference framework to facilitate these conversations and drive enterprise-wide alignment.”

The expansion is a conceptual taxonomy rather than a mandate to redraw the org chart. Many organizations already split these responsibilities differently, and whether they can align them across entrenched silos remains an open question the model cannot answer on its own.


igrm-final-4-1

Information Governance Reference Model v4.1. Source: EDRM (EDRM.net), CC BY 4.0


The perpetual policy-process cycle, explained

At the heart of the update sits a concept EDRM calls the perpetual policy-process cycle. The idea is that governance is never finished. Policy shapes process, real-world implementation exposes gaps, and those lessons feed the next round of policy.

For practitioners, the cycle may strengthen defensible-disposition positions by linking written policy to actual implementation and review. Teams that can show a documented loop between policy and practice are better positioned to defend retention and deletion decisions when a matter lands in litigation or a regulator comes asking. The model gives that loop a name and a place on the map.

The revised guidance also sharpens the framework for balancing the value, risk, and cost of information, and adds practical strategies for operationalizing governance at enterprise scale. EDRM said the guidance reflects lessons learned from organizations worldwide.

Why this sets up EDRM 2.0

The IGRM update is the opening move in a larger overhaul. Mack said v4.1 will serve as the foundation for a coming revision to the Electronic Discovery Reference Model itself, the EDRM 2.0 project that EDRM launched in 2023 to modernize its long-standing eDiscovery model for emerging use cases, new technologies, and global practice.

Eric Mandel, IGRM project trustee and director of Global Advisory Services at KLDiscovery Ontrack, framed v4.1 as the product of volunteer practitioners rather than a single author.

“The world of information governance has changed profoundly over the past decade,” Mandel said. “Bringing v4.1 to life was a collaborative effort by a remarkable community of practitioners who volunteered their expertise and energy.”

The named contributors to IGRM 4.1 include Matthew Bernstein, Cohen, Robert Daniel, Tara Emory, Kyle Goyette, Ronald Hyams, Doug Kaminski, Brenda Kramer, Paul Mullon, Rebecca Perry, Eric M. Robinson, Eric Sedwick, and Jennifer Williams.

What practitioners should do now

The practical work starts with vocabulary. Teams can map the seven stakeholder roles against their own org chart and look for the seats no one is filling, the privacy or security voice missing from the records retention conversation being a common gap. From there, the User Guide gives language for writing the policy-process loop into a governance charter.

Governance leads should also treat AI-generated content as potentially in-scope governable information. Chat logs, prompts, outputs, and synthetic documents may trigger retention, privacy, security, and discovery obligations depending on their content, business use, jurisdiction, and governing policies.

The model is free to use under a Creative Commons Attribution 4.0 license, which lowers the cost of adoption for teams that want to build training and onboarding around it.

The release arrives as governance teams look for a steadying reference amid constant change. EDRM positions v4.1 as that kind of anchor, a shared map for keeping policy and practice aligned while the data underneath multiplies, though its real test will be adoption. Those AI transcripts, summaries, and draft documents will keep accumulating whether or not a policy exists to catch them. The question v4.1 leaves with every governance team is whether their map can keep pace with the data filling it. How will you put the refreshed guidance to work?

News sources



Assisted by GAI and LLM Technologies

Additional reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.