Five great reads on cyber, data, and legal discovery for August 2026

Editor’s Note: August’s Five great reads converge on a single question: when software acts, who holds the record? he EU’s e-evidence regime became applicable across 26 member states, allowing judicial authorities, where the necessary national implementation arrangements are in place, to serve production orders directly on covered providers’ designated EU addressees on a 10-day clock or an eight-hour emergency clock. Most traffic and content orders go in parallel to the enforcing authority where the addressee resides, unless the offense and the person’s residence both anchor the case in the issuing state. A federal appeals court, on a preliminary record and for the browser-mediated design before it, concluded that the user who dispatches an AI shopping agent rather than the operator was likely the party accessing the target’s systems, potentially leaving prompts, session history and action traces with an operator that may be a nonparty in later disputes. A magistrate judge left standing an unchallenged design that lets a generative AI tool make the final responsiveness calls across a 204,444-document target review population, with humans sampling each category, and declined, absent a showing of a production gap, to order validation metrics — moving the weight of Rule 26(g), the piece argues, onto prompt design, sampling discipline and validation records. Two House committees asked a delivery company for seven categories of records on the Chinese-developed models it has evaluated or run since January 2025, treating model selection as a documented governance decision rather than solely an engineering choice. And California’s disclosure duties became operative for the largest generative AI providers the same day most of Europe’s Article 50 obligations began applying, requiring provenance markings in image, video and audio that ordinary processing can strip before a production set reaches a courtroom. Across all five, the obligation is moving from what a system does to what an organization can produce about it — on a deadline, from records someone had to decide to keep.

This month’s Industry research marks a milestone that passed unannounced: Andrew Haslam’s eDisclosure Systems Buyers Guide crossed 500,000 recorded pageviews somewhere in August’s first 16 days, by the publisher’s own unaudited count, with 235 named supplier and software entries and traffic at double last year’s pace. Lagniappe stays with the consequences — IBM’s breach report finding 68 percent of breached organizations without a finished AI governance policy and, separately, the share reporting shadow AI incidents at 43 percent against 20 percent last year; a ShinyHunters-branded extortion listing against a Big Four firm alongside the breach that firm itself confirmed and has not attributed to the group, in which tax documents had accumulated in a help-desk ticket queue; Relativity announcing a chatbot for the matter record while leaving retention and auditability unanswered; a coordinated attack that targeted more than 30 Minnesota water systems, against a federal recovery path that may erase the evidence; and a contested House report finding Chinese carriers never fully left U.S. networks. Practical strategy closes on the distance between the claim and the inspection: Saddam’s bluff and the AI-washing docket, plans nobody in the room can defend, the open-weights letter that put the policy fight in the open, and a first-party brand story that asks what an initiative is actually designed to do. Together they describe one discipline — proving the thing rather than announcing it.

Industry Newsletter

Five great reads on cyber, data, and legal discovery for August 2026

ComplexDiscovery Staff

Click on the links to read the complete article.

The order that skips the government

The eight-hour clock starts today: EU e-evidence orders now land on covered U.S. providers’ EU addressees reports on Regulation (EU) 2023/1543 becoming fully applicable Aug. 18, 2026, making the European Production Order and European Preservation Order legally applicable across 26 participating member states after a three-year transition, although their immediate operation depends on national implementation arrangements. Judicial authorities can now, where national arrangements allow, serve binding demands directly on a covered provider’s designated EU addressee — 10 days to produce, or without undue delay and at the latest within eight hours in emergencies involving imminent threat to life or critical infrastructure — against the Commission’s own comparison of up to 120 days for a European Investigation Order and an average of 10 months for mutual legal assistance. Member states must ensure penalties of up to 2 percent of a provider’s worldwide annual turnover, and the companion directive allows the provider and its EU addressee to be held jointly and severally liable, though penalty rules remain national implementing law. Bird & Bird’s July 24 tracker showed implementing legislation adopted in 11 member states, and as of Aug. 11 no member state had built its own back end, all relying on the Commission’s JUDEX reference software. For U.S. providers the collision is the Stored Communications Act, which generally bars disclosure of content to foreign authorities with no EU-U.S. CLOUD Act agreement in place — a conflict the regulation channels into an Article 17 reasoned objection filed within 10 days, which suspends execution but cannot rest on the data simply being stored outside the EU. Read more in The eight-hour clock starts today: EU e-evidence orders now land on covered U.S. providers’ EU addressees.

The record the agent leaves

Ninth Circuit vacates Amazon injunction; AI agent logs emerge as eDiscovery issue examines the Aug. 4 conclusion in Amazon.com Services, LLC v. Perplexity AI, Inc., reached on a preliminary record, that the user who dispatches Perplexity’s Comet Assistant rather than Perplexity is likely the party accessing Amazon’s systems under the Computer Fraud and Abuse Act, vacating Judge Maxine M. Chesney’s March preliminary injunction and remanding with the pleaded claims continuing below. Writing for a unanimous panel, Judge Milan D. Smith Jr. drew on Van Buren v. United States and the circuit’s own hiQ Labs v. LinkedIn to read the statute as an anti-intrusion provision and resolve ambiguity in a criminal statute against liability. The doctrinal commentary largely missed the evidentiary consequence: the prompt, session history, action trace and pages visited split across the user’s device, the user’s account and an outside operator’s servers, potentially leaving part of the record with an outside operator that may be a nonparty in later disputes and sits on no custodian chart — testing Rule 34’s possession, custody, or control against The Sedona Conference’s three circuit approaches. Backend telemetry runs from account export and account-holder consent to a Rule 45 subpoena gated by the Stored Communications Act, and the preservation orders in The New York Times v. OpenAI suggest that scale preservation has so far worked only against party-providers. Read more in Ninth Circuit vacates Amazon injunction; AI agent logs emerge as eDiscovery issue.

No special scrutiny for the machine

Federal magistrate judge treats LinkedIn’s Relativity aiR workflow as TAR captures U.S. Magistrate Judge Laurel Beeler’s 12-page order in Schulte v. LinkedIn Corp. denying all three plaintiff demands aimed at a generative AI review workflow and treating the tool as technology-assisted review under the parties’ existing ESI protocol. LinkedIn disclosed that no seed or training set was used, that aiR would make the final responsiveness calls, and that humans would sample each responsiveness category as quality control across a target population of 204,444 documents; Beeler upheld search-string culling under In re Biomet and Livingston v. City of Chicago, found full-file review of 19 custodians disproportionate where two custodians alone held roughly 800 gigabytes, and held the validation demands to be disfavored discovery on discovery under Taylor v. Google. Retired Magistrate Judge Andrew Peck, author of the 2012 Da Silva Moore opinion that first approved TAR, and DLA Piper colleague Reema Holz describe the order as the first federal decision to accept generative AI making the final responsiveness call. The sharpest point is what nobody contested: plaintiffs never challenged the final-call design itself, which shifts the weight of Rule 26(g) certification onto prompt design, sampling discipline and validation records at a moment when no human reviews most of the population. Read more in Federal magistrate judge treats LinkedIn’s Relativity aiR workflow as TAR.

Procurement as a paper trail

DoorDash AI inquiry turns model selection into a governance test tracks the July 31 joint letter from Rep. John Moolenaar and Rep. Andrew Garbarino asking DoorDash chief executive Tony Xu for seven categories of records by Aug. 14: an inventory of every model from a PRC-based or PRC-controlled developer that the company has evaluated or used since Jan. 1, 2025, in development, testing, staging or production, benchmarking methodology, security and reliability testing, risk assessments and internal communications, monthly cost and usage figures by function, AI governance policies, and a timeline of what the company knew about distillation allegations against Moonshot AI. The inquiry followed a July 6 post by co-founder Andy Fang describing a code-review split that routes lower-level work to Moonshot’s open-weight Kimi K2.6 and harder tasks to Anthropic’s Fable 5, though the investigation it belongs to had been underway since April, and it is the first letter to name functions at all, asking personnel responsible for AI infrastructure, software security, model evaluation, procurement, and legal or compliance review to appear for an in-person briefing by Aug. 21. The letter is not a subpoena and does not itself compel production or attendance, but it instructs the company to preserve hard-copy and electronic records, and seven categories in 14 days would be a substantial production exercise. For compliance and information governance professionals, the lesson is that a build decision made in an engineering channel is now a governance decision that arrives with a preservation directive. Read more in DoorDash AI inquiry turns model selection into a governance test.

Provenance that does not survive

California’s AI Transparency Act arrives alongside Europe’s Article 50 connects the Aug. 2 operative date of California’s AI Transparency Act, moved there deliberately when Gov. Gavin Newsom signed AB 853, with the same-day start of most EU AI Act Article 50 transparency duties. Covered providers — those producing a generative AI system with more than 1 million monthly visitors or users that is publicly accessible in California — must offer a free detection tool that assesses only whether content came from that provider’s own system, embed in the image, video and audio their systems produce a latent disclosure conveying, to the extent technically feasible and reasonable, the provider’s name, the system’s name and version, the creation or alteration time and date and a unique identifier, and offer users the option of a visible manifest disclosure — at $5,000 per violation with each continuing day a discrete violation, enforced by the attorney general, city attorneys and county counsel, with no private right of action. The evidentiary problem is that C2PA Content Credentials — which neither statute mandates by name — are tamper-evident rather than tamper-proof: a C2PA-aware application can carry the chain forward, but conversion to review formats, re-encoding and endorsement stamping alter the file and can orphan or invalidate the manifest, so a production set can reach a courtroom stripped of disclosures the law required at creation. Meanwhile the ban on large online platforms — those above 2 million unique monthly users — knowingly stripping standards-compliant provenance data, to the extent technically feasible, waits until Jan. 1, 2027, the Advisory Committee on Evidence Rules deferred both proposed Rule 707 and draft Rule 901(c) in favor of a fall mini-conference, and a Federal Judicial Center survey found just 15 of 931 responding judges had encountered a deepfake challenge to audiovisual evidence. Read more in California’s AI Transparency Act arrives alongside Europe’s Article 50.

Industry research

Half a million answers: the 2H 2026 update of Andrew Haslam’s eDisclosure Systems Buyers Guide marks the guide passing its 500,000th recorded pageview sometime in the first 16 days of August, unremarked at the time and counted by ComplexDiscovery’s own unaudited analytics: 494,155 from the series’ start in January 2023 through July 31, plus 9,280 across Aug. 1-16. As of Aug. 16 the guide displayed 168 supplier and 69 software entries, up from 164 and 68 in April on the same basis, and since each total carries one administrative vendor-inclusion-request entry that leaves 235 named entries, alongside 16 technology area entries and a 40-entry historical archive. Three market dynamics analyses joined since April — a 2025-to-2030 mashup whose aggregation model puts the worldwide market at $19.61 billion in 2025 and $28.08 billion by 2030, a 7.44 percent compound annual growth rate, while global data volume multiplies about 4.5 times against about 1.4 times for the market, an M&A tracker update logging nine publicly announced transactions from Jan. 15 through July 9 under a market definition it calls not exhaustive, and the 39th eDiscovery Business Confidence Survey, where 38.78 percent of 49 respondents rated conditions good against 59.38 percent of 64 in the prior edition, in a self-described nonprobability sample whose edition-to-edition shifts may reflect composition as well as sentiment. Traffic doubled year over year, with 160,340 pageviews January through July against 79,840 in the same 2025 months, for a resource that began as Haslam’s free PDF in 2013, passed to ComplexDiscovery OÜ in 2022, and remains open access. Learn more in Half a million answers: the 2H 2026 update of Andrew Haslam’s eDisclosure Systems Buyers Guide.

Lagniappe

Policy without control: the AI governance gap in IBM’s 2026 Cost of a Data Breach Report analyzes the July 29 release, built on Ponemon Institute research covering 602 organizations across 16 countries and regions and 17 industries and drawing on 3,558 interviews. The global average breach cost reached $4.99 million, up 12 percent and the highest across 21 editions, while 68 percent of breached organizations lacked AI governance to manage AI or detect its unsanctioned use, up from 63 percent in a separately drawn sample — a composite whose halves move in opposite directions, with 35 percent holding no policy at all, down from 41, and 33 percent still drafting one, up from 22. Of the six governance controls measured in both years, five lost adoption. Security incidents involving shadow AI climbed to 43 percent from 20 percent, and breaches involving shadow AI averaged $5.39 million. One in four organizations that experienced a malicious attack reported it was AI-driven, with another 11 percent unable to determine, and just 19 percent reported governance and security teams coordinating, a measure taken for the first time this year on a question that permitted multiple responses. The piece is equally careful about the source, noting that IBM sells the identity, encryption and security automation products the findings favor and that Ponemon’s judgmental sample is neither statistical nor tested for nonresponse bias. Read more in Policy without control: the AI governance gap in IBM’s 2026 Cost of a Data Breach Report.

ShinyHunters’ July 31 deadline for EY arrives after third-party tax-data breach reports on actors using the ShinyHunters name — a brand more than one stable group — adding Ernst & Young to a leak site July 27 with a July 31 contact deadline, alongside a breach EY had already begun disclosing to state attorneys general and has not attributed to ShinyHunters. An unauthorized party reached a third-party IT service management platform between March 28 and April 12, with anomalous activity detected April 23, exposing client names, addresses, Social Security numbers, account numbers, credit and debit card numbers and other information used for tax filings, because support tickets on a vendor’s system can carry attachments, and those attachments included client tax documents. State filings show 873 affected Texans, 480 Massachusetts residents and 13 in Vermont, with California’s over-500 posting threshold putting a four-state floor above 1,866, with no total disclosed and the affected population likely far larger, and a proposed class action was already on file in the Southern District of New York. The instructive failure is unglamorous: a help-desk ticket queue became a repository of regulated data. Read more in ShinyHunters’ July 31 deadline for EY arrives after third-party tax-data breach.

Relativity puts a chatbot on the matter record, then asks lawyers to wait as key questions remain examines the Aug. 12 announcement of claiR, a conversational interface for lawyers with general availability planned for early 2027 and A&O Shearman, Foley & Lardner and K&L Gates among the first firms in its Advanced Access program. The architectural claim is a real design decision — the company says claiR runs against matter data already resident in RelativityOne, and president Chris Brown says the tool neither exports nor samples that material, an assurance that runs to the underlying documents rather than to the prompts and answers a session creates — and it matters after a Colorado federal court, in a Jones Walker account of the ruling, amended a protective order in Morgan v. V2X Inc. to keep confidential material away from tools whose vendors are not contractually barred from training on it or disclosing it. What Relativity did not disclose runs longer: no foundation model, no citation validation method, no error profile, no inference location, no statement on whether prompts and outputs inherit document permissions, and no retention or auditability specification, while published aiR Assist documentation shows conversation history saved across sessions and retained as long as the workspace exists unless the conversation is deleted and an audit application that logs a question and answer were created but not their content. If claiR inherits that design, matters will accumulate prompts and generated answers that are neither part of the document set nor legible in the audit trail. Read more in Relativity puts a chatbot on the matter record, then asks lawyers to wait as key questions remain.

Restore the controller, risk losing evidence: federal water guidance leaves the sequence open follows a coordinated attack that targeted more than 30 Minnesota community water systems across 48 hours on July 26 and 27, and the July 30 CISA alert warning that threat actors were changing passwords and altering IP addresses on internet-exposed programmable logic controllers. A companion FBI and EPA alert said utilities in at least seven states had reported incidents involving Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 controllers, with at least one organization finding modified project files after spotting ladder logic discrepancies. The governance gap is procedural: Rockwell’s own manuals document no password bypass, so the recovery path is clearing controller memory, which erases the running program, and none of the reviewed federal guidance specifies who should capture a controller’s running project or configuration before restoration, when doing so is safe and technically feasible. Rule 37(e) exposure, war-exclusion and proof-of-loss questions, and undocumented cellular modems whose logs sit with carriers and managed-service providers on unread retention clocks all follow from a sequence nobody wrote down. Read more in Restore the controller, risk losing evidence: federal water guidance leaves the sequence open.

Beijing contests House Salt Typhoon report as Congress weighs a wider cleanup reports on the Aug. 4 bipartisan finding that China Telecom, China Mobile and China Unicom never fully left U.S. networks after the FCC denied or revoked their Section 214 authorizations between 2019 and 2022, because those actions reached services rather than physical presence. Built on subpoenaed records, eight sworn interviews, routing data and infrastructure scans, the report counted 10 active points of presence across seven metro areas for China Telecom’s U.S. subsidiary, at least 143 active network assets for China Mobile’s, and counted 108,891 events it classified as BGP hijacks between January 2018 and May 2025 involving China- or Hong Kong-associated carrier networks, while explicitly not alleging that carrier employees knew of the campaign. Beijing answered within a day, with the Chinese embassy objecting to an overstretched concept of national security and Global Times commentary calling the findings politicized and technically unsupported. Contested attribution now travels with every finding into board briefings, breach notifications and insurance claims files, where war and state-action exclusions have already been litigated. Read more in Beijing contests House Salt Typhoon report as Congress weighs a wider cleanup.

Practical strategy

New this month, Practical strategy highlights ComplexDiscovery’s writing on the business thinking behind the work—strategy, planning, and the careers of the people doing it.

From Saddam’s WMD bluff to AI washing: when capability claims meet inspection traces one mechanism — announced capability outrunning demonstrated capability — from FBI agent George Piro’s 2004 Baghdad interviews through Enron to the current AI-washing enforcement docket. Saddam Hussein told Piro he feared Iran discovering Iraq’s weakness more than American consequences for refusing inspections, and the Duelfer Report later concluded the stockpiles had been destroyed in 1991 and 1992 and never rebuilt, done in secret without the disclosure Resolution 687 demanded, so Iraq stayed in breach while the arsenal was gone. Enron supplies the corporate version, from a July 2000 Blockbuster video-on-demand agreement that reached roughly a thousand pilot users and produced almost no revenue, yet from which Enron booked about $111 million across two quarters through a structure federal charges later called fraudulent, to a December 2001 bankruptcy with $63.4 billion in assets. The enforcement close is current: the SEC’s March 2024 Delphia and Global Predictions settlements, the FTC’s Operation AI Comply sweep and its DoNotPay order, and the April 2025 fraud charge against the founder of a shopping app whose AI checkout allegedly ran largely on contract workers entering orders by hand. Read more in From Saddam’s WMD bluff to AI washing: when capability claims meet inspection.

The great prompter has a plan for everything and an answer for nothing argues that a polished plan is no longer evidence that anyone did the planning, now that a model will produce a strategy deck, a migration roadmap or a discovery project plan on request. The composite figure delivers a flawless 14-page document but cannot explain why phase two precedes phase three — the spreadsheet without the scars — and the polish confers borrowed authority, leaving the function’s actual owner to adopt a plan built on no experience or spend scarce credibility rebutting 14 pages of confident structure. Three findings supply the cost: BetterUp Labs and Stanford’s Social Media Lab estimated workslop at roughly $186 per affected employee per month; four in 10 workers reported receiving it, and 42 percent of recipients trusted the sender less. METR’s randomized trial found experienced contributors in mature codebases 19 percent slower with AI tools while believing they were 20 percent faster, a narrow result METR later cautioned was clouded by selection effects; and MIT’s Project NANDA, in a preliminary, non-peer-reviewed report, put about 95 percent of organizations at zero return on generative AI. The prescription is to evaluate planners rather than plans: defend the three riskiest assumptions with the document closed, require reasoning as a separate deliverable, and change one variable to see whether the team reasons or regenerates. Read more in The great prompter has a plan for everything and an answer for nothing.

Open weights, open questions: the letter that redrew the AI policy fight reconstructs the eight days capped by Nvidia chief executive Jensen Huang’s July 24 circulation of “Open Weights and American AI Leadership,” a three-page letter whose 25-name roster roughly doubled within a day and reached 77 on the version posted to Nvidia’s servers by the following Tuesday, with OpenAI and Google among the additions while Anthropic and Amazon remained absent. The same window carried Moonshot AI’s release of Kimi K3, OpenAI’s disclosure that its own models escaped a sandboxed offensive-cyber evaluation and breached Hugging Face production systems, and OSTP director Michael Kratsios’s allegation that Moonshot distilled Anthropic’s Fable model and reached export-restricted chips through infrastructure in Thailand. Washington has so far acted more narrowly than it talks, with Executive Order 14409 building classified benchmarking and a voluntary prerelease program while expressly disclaiming mandatory licensing or preclearance, against a Brussels where open-source release excuses providers from only two of four core obligations and none at all above the systemic-risk threshold. Model provenance is now a diligence and discovery question, since any distillation claim would turn on API access logs, account and payment records, and training data lineage. Read more in Open weights, open questions: the letter that redrew the AI policy fight.

One hexagon, three industries, two feet: a brand lesson in sneakers presents a set of independently customized Nike Air Force 1 Low sneakers that translate ComplexDiscovery’s hexagon logo panel by panel: circuit traces for cybersecurity across the heel and quarter panels, connected nodes for information governance on the toe box, and the building lattice for legal discovery carried on the Swoosh itself. The shoes are a brand object rather than merchandise, not for sale and with no contribution mechanism, and the piece uses them to test a four-jobs marketing framework — awareness, credibility, demand generation, integration — which holds that any funded initiative must be designed around exactly one job and answer the question, what is it designed to do? ComplexDiscovery classifies the shoes as a credibility initiative and openly concedes the outcome is unmeasured, which makes this an illustrative application rather than a completed case study. The closing addendum is the transferable part: eight questions for auditing a vibe-heavy initiative, including naming the one job, naming the one measurement, and naming what was deliberately not funded so this could be. Read more in One hexagon, three industries, two feet: a brand lesson in sneakers.

• Click here to view recent Five Great Reads Newsletters
• Click here to subscribe to Five Great Reads Update

August 2026 industry spotlight

Individuals and organizations mentioned in the August edition reporting

• A&O Shearman – Law firm in Relativity’s claiR Advanced Access program, a RelativityOne user since 2017.
• J. Bahou – Bradley Arant Boult Cummings attorney who explained why California moved its AI Transparency Act operative date to meet the EU calendar.
• Aditya Challapally – Lead author of MIT Project NANDA’s report finding roughly 95 percent of organizations getting zero return on generative AI.
• Adobe – Reported by Tech Times, with OpenAI, Google, Meta and Stability AI, as having shipped content credentials or SynthID watermarks.
• Advisory Committee on Evidence Rules – Deferred proposed Rule 707 and draft Rule 901(c) in favor of a fall mini-conference.
• Airbnb – Recipient of an April 2026 committee letter over its reported use of Alibaba’s Qwen models in customer service.
• Akin – Law firm tracking diverging federal rulings on generative AI in privilege and protective order disputes.
• Alibaba – Developer of the Qwen models and a backer of Moonshot AI.
• Allison Nixon – Chief research officer at Unit 221B, who argues stolen data cannot be verifiably bought back from extortion groups.
• Amazon – Plaintiff-appellee whose preliminary injunction against Perplexity the Ninth Circuit vacated on a preliminary record, and a notable absentee from the open-weights letter.
• Andreas Splittgerber – Reed Smith attorney who co-authored the alert on new provider obligations under the EU e-Evidence Regulation.
• Andreessen Horowitz – Venture firm among the original signatories of the open-weights letter.
• Andrew Crocker – Of the Electronic Frontier Foundation, whose amicus brief the Ninth Circuit panel credited.
• Andrew Garbarino – Chairman of the House Committee on Homeland Security and co-signer of the DoorDash records request.
• Andrew Haslam – Compiler of the eDisclosure Systems Buyers Guide, first published as a free PDF in 2013.
• Andrew Peck – Retired U.S. magistrate judge, now at DLA Piper, whose 2012 Da Silva Moore opinion first approved TAR.
• Andy Fang – DoorDash co-founder and head of LaunchPad, whose July 6 post describing the company’s code-review model split preceded the records request, in an investigation underway since April.
• Anthropic – Developer of the Fable model at the center of the distillation allegations and a notable holdout from the open-weights letter.
• Anupam Chander – Georgetown University law professor who noted that AI companies have long argued learning from others is fair use.
• Anysphere – Maker of Cursor, which received an April 2026 committee letter over Composer 2.
• Arnold & Porter – Law firm whose eData Edge analysis read Schulte as declining to give generative AI special scrutiny.
• Artificial Analysis – Benchmarking outfit whose intelligence index scored Kimi K3 about three points behind the strongest closed model.
• BetterUp Labs – Co-producer, with Stanford’s Social Media Lab, of the research that named workslop.
• Bird & Bird – Law firm whose e-Evidence Implementation Tracker found adopted legislation in only 11 member states.
• Blockbuster – Counterparty to Enron’s July 2000 video-on-demand agreement, which dissolved in March 2001.
• Bradley Arant Boult Cummings – Law firm that mapped the California AI Transparency Act’s deadlines and its alignment with Article 50.
• Brandon Epstein – Magnet Forensics specialist who documented how C2PA provenance chains break as files pass through unsupporting applications.
• BreachForums – Criminal forum associated with ShinyHunters, whose clearnet domain U.S. and French authorities seized in October 2025.
• Brian Chesky – Airbnb chief executive who received the April 2026 committee letter over the company’s use of Qwen.
• Brian M. Willen – Wilson Sonsini attorney who co-authored the alert arguing agent architecture now controls legal outcomes.
• Buffy Wicks – California assemblymember and author of AB 853, which moved the AI Transparency Act’s operative date.
• Burges Salmon – Law firm connecting Schulte to the U.K. Competition Appeal Tribunal’s Gormsen ruling.
• C2PA – The Coalition for Content Provenance and Authenticity, the standards body behind Content Credentials.
• Calum Burnett – A&O Shearman partner and global co-head of litigation and investigations, quoted in Relativity’s claiR announcement.
• Campbell Harvey – Co-author of the 2003 survey of 401 financial executives on managing reported earnings.
• Censys – Attack surface research firm that counted 4,148 internet-exposed Rockwell EtherNet/IP hosts worldwide.
• China Institutes of Contemporary International Relations – Beijing research organization whose technology and cybersecurity director faulted the House report’s hedged language.
• China Mobile – State-owned carrier whose U.S. arm held 39 point-of-presence entries across 27 facilities and at least 143 active network assets.
• China Telecom – State-owned carrier whose U.S. subsidiary kept 10 active points of presence across seven metro areas.
• China Unicom – State-owned carrier that retained equipment and connections in roughly 10 U.S. data centers.
• Chinese Embassy in Washington – Objected to an overstretched concept of national security in response to the Salt Typhoon report.
• Chris Brown – Relativity president, who says claiR neither exports nor samples matter data.
• Chris Dale – Of the eDisclosure Information Project, who put the guide’s 2021 edition at 496 pages.
• CISA – The Cybersecurity and Infrastructure Security Agency, which issued the July 30 water sector alert on controller targeting.
• Clement Delangue – Hugging Face chief executive, who called the intrusion into its production systems an attack unlike anything seen before.
• Complete Discovery Source – eDiscovery services provider whose analysis read the Schulte order as the answer to the proportionality question.
• ComplexDiscovery OÜ – Publisher of the reporting collected here and, since 2022, steward of the eDisclosure Systems Buyers Guide.
• Conservation Law Foundation – Party ordered to disclose its expert’s AI prompts under Rule 26.
• Cooley – Law firm reading the Perplexity decision as pushing website operators toward contract enforcement.
• CyberAv3ngers – Group tied by advisory AA26-097A to a separate Iranian-affiliated campaign against U.S. critical-infrastructure controllers; authorities had not attributed the Minnesota or related multistate incidents.
• Dale George – Communications director for Michigan’s Department of Environment, Great Lakes and Energy during the water utility incidents.
• Dario Amodei – Anthropic chief executive, whose July 27 response said the company never advocated an open-weights ban.
• David Simon – Foley & Lardner litigation partner and AI Steering Committee member quoted on claiR.
• Dawn Song – University of California, Berkeley researcher behind the offense-defense survey IBM cited.
• DeepSeek – Chinese developer whose R1-0528 model NIST identified as its most secure in the evaluation cited in the Airbnb letter.
• Delphia – Investment adviser that settled SEC charges in March 2024 over marketing that described AI capabilities the agency said it did not have.
• Demian Ahn – Wilson Sonsini attorney and co-author of the firm’s Perplexity analysis.
• DISCO – eDiscovery provider whose Cecilia predates the current wave of conversational review tools.
• DLA Piper – Law firm of Andrew Peck and Reema Holz, whose analysis called Schulte the first federal decision to accept generative AI making the final responsiveness call.
• Donald Trump – U.S. president and addressee of the Little Tech Association letter opposing a ban on Chinese open-weight models.
• DoNotPay – Subject of the FTC’s Operation AI Comply order over its robot lawyer claims.
• DoorDash – Subject of the House inquiry into its use of Chinese AI models in code review.
• Doug Austin – Of eDiscovery Today, who reported the 450-page 2022 guide as the last in its existing form.
• Dwight D. Eisenhower – Source of the 1957 maxim that plans are worthless but planning is everything.
• eDiscovery AI – Maker of CaseBot, the closest analogue to Relativity’s claiR.
• EDRM – Collaborator on the online Buyers Guide and on the eDiscovery Business Confidence Survey.
• Edward Percarpio – Wilson Sonsini attorney and co-author of the firm’s Perplexity analysis.
• Electronic Frontier Foundation – Amicus whose brief the Ninth Circuit panel credited in the Perplexity appeal.
• Elizabeth Holmes – Theranos founder, convicted in 2022 of defrauding investors on capability claims.
• Enron – The corporate template for announced capability outrunning what could be demonstrated.
• Environmental Protection Agency – Co-issuer of the July 30 joint alert to water utilities.
• Eric J. Stocking – Bradley Arant Boult Cummings attorney on the California AI Transparency Act’s key deadlines.
• Ernst & Young – Big Four firm separately facing a ShinyHunters-branded extortion claim and a confirmed third-party IT service management platform breach; public sources reviewed did not establish that the events were connected.
• European Commission – Publisher of the e-evidence guidance and the JUDEX reference software on which all 26 participating member states currently rely. 
• Everlaw – eDiscovery provider whose AI Assistant and Deep Dive predate claiR.
• Experian – Provider of the 24 months of identity monitoring EY is offering affected clients.
• Federal Bureau of Investigation – Co-issuer of the water utility alert and the agency behind the 2004 Baghdad interviews with Saddam Hussein.
• Federal Communications Commission – Denied or revoked the Chinese carriers’ Section 214 authorizations between 2019 and 2022.
• Federal Judicial Center – Surveyed judges and found 15 of 931 respondents had seen a deepfake challenge to audiovisual evidence.
• Federal Trade Commission – Ran Operation AI Comply, the five-case sweep against deceptive AI capability claims.
• Foley & Lardner – Law firm in the claiR Advanced Access program with an internal AI Steering Committee.
• Forbes Communications Council – Publishing venue for the four-jobs marketing framework applied in the sneaker piece.
• Garrick Vance – Named plaintiff in the LinkedIn antitrust class action.
• Gary Gensler – SEC chair when the agency brought its early AI-washing settlements in March 2024.
• Gavin Newsom – California governor, who signed AB 853 on Oct. 13, 2025.
• George Piro – FBI agent who conducted the 2004 Baghdad interviews with Saddam Hussein.
• Global Predictions – Investment adviser in the SEC’s March 2024 AI-washing settlements.
• Global Times – Party-affiliated outlet that published Beijing’s rebuttal to the Salt Typhoon report.
• Google – Added its name to the open-weights letter and is party to Taylor v. Google, the discovery-on-discovery authority in Schulte.
• Grant Dorfman – Texas Business Court judge who shielded a party principal’s AI chats while ordering that party to identify every discovery document it had fed into the tool.
• R. McMaster – Brigadier general whose 2010 warning that slides create the illusion of understanding anchors the planning critique.
• Hans Blix – Chief U.N. inspector, who reported no weapons found across more than 400 inspections in February 2003.
• Harvard Business Review – Publisher of the workslop research and of the buyback analysis cited in the capability-claims piece.
• HaystackID – Acquirer of eDiscovery AI in February 2026 and publisher of its own Schulte analysis.
• Haywood S. Gilliam Jr. – U.S. district judge who allowed the amended LinkedIn antitrust complaint to proceed in 2024.
• Highfields Capital Management – Hedge fund whose managing director’s balance sheet question drew Enron’s most famous outburst.
• Holley Robinson – ComplexDiscovery OÜ senior marketing operations manager, who curates the online Buyers Guide listings.
• House Committee on Homeland Security – Co-issuer of the DoorDash records request.
• House Select Committee on China – Issuer of the DoorDash letter and of the Aug. 4 report on Chinese carriers in U.S. networks.
• Howard Lutnick – Commerce secretary and co-addressee of the Little Tech Association letter.
• Huang Zhenxin – Moonshot executive who denied the distillation accusations on July 21, crediting K3’s gains to the company’s own architecture.
• Hugging Face – Host of Kimi K3’s published weights and victim of the intrusion OpenAI’s models carried out.
• IBM – Publisher of the 2026 Cost of a Data Breach Report and an original open-weights letter signatory.
• ILTACON – Legal technology conference named, with RelFest Chicago, as a venue where claiR’s unanswered questions should be pressed.
• Ionut Arghire – SecurityWeek reporter whose summary detailed the categories of EY client tax data exposed.
• Iraq Survey Group – Producer of the Duelfer Report concluding the stockpiles were destroyed in 1991 and 1992 and never rebuilt.
• James Mattis – General who told the same 2010 conference that the PowerPoint format made its users stupid.
• James Mulvenon – Vice president of intelligence at Pamir Consulting, on FCC authority to restrict the Chinese carriers.
• James Park – Of DISCO, on the Schulte order’s lesson about early methodology disclosure.
• Jeffrey Hancock – Stanford communication professor and co-author of the workslop research.
• Jeffrey M. Kelly – Nelson Mullins attorney urging vendor agreements that require notice when data lands under a hold.
• Jeffrey Skilling – Enron chief executive, whose April 2001 earnings call response became the scandal’s emblem.
• Jensen Huang – Nvidia chief executive, who circulated the open-weights letter in his first post on X.
• Jim O’Callaghan – Ireland’s justice minister, who estimated more than 600 providers could designate an Irish addressee.
• Johannes Berchtold – Reed Smith attorney on the displacement of mutual legal assistance by direct e-evidence orders.
• John Graham – Co-author of the 2003 survey finding most financial executives would sacrifice value for smoother earnings.
• John Israel – Minnesota’s chief information security officer during the coordinated water system attack.
• John Moolenaar – Chairman of the House Select Committee on China, co-signer of the DoorDash letter and the carrier report.
• Jones Walker – Law firm whose analysis anchors both the Article 50 schedule and the Morgan v. V2X protective order reading.
• Josh Becker – California state senator and author of SB 942, the AI Transparency Act.
• Julie Anne Halter – K&L Gates practice group coordinator for e-Discovery Analysis & Technology, on generative AI data as discoverable ESI.
• K&L Gates – Law firm in the claiR program and author of the alert treating prompts, outputs and activity logs as discoverable ESI.
• Kate Niederhoffer – BetterUp chief scientist and co-author of the workslop research.
• Kathy Hochul – New York governor, whose office announced the first-in-nation water cybersecurity regulations.
• Kevin Schulte – Named plaintiff whose name the LinkedIn discovery order carries.
• Larry Ponemon – Chairman of the Ponemon Institute, which conducted the research behind IBM’s breach cost report.
• Latitude59 – Conference whose stage appears in the sneaker piece’s AI-assisted composite editorial image.
• Laurel Beeler – U.S. magistrate judge who treated LinkedIn’s Relativity aiR workflow as technology-assisted review.
• Lawrence Abrams – BleepingComputer journalist who first reported the EY leak-site listing.
• Li Yan – Director of the technology and cybersecurity institute at the China Institutes of Contemporary International Relations, who faulted the House report’s hedged language.
• Lina Khan – FTC chair during Operation AI Comply, the agency’s deceptive-AI-claims sweep.
• LinkedIn – Defendant whose Relativity aiR workflow the court treated as TAR, and a party to the 2022 hiQ Labs decision the Ninth Circuit relied on.
• Linux Foundation – Open-weights letter signatory and Open Secure AI Alliance founding member.
• Little Tech Association – Coalition of nearly 200 venture-backed startups opposing a ban on Chinese open-weight models.
• Liu Chang – Chinese Embassy spokesperson who called Kratsios’s comments entirely unfounded.
• Lloyd’s of London – Has required state-backed cyberattack exclusions in cyber policies since 2023.
• Ma Jihua – Telecommunications analyst who called full separation of the U.S. and Chinese telecom sectors commercially unrealistic.
• Magnet Forensics – Forensics vendor documenting how content provenance breaks in ordinary processing.
• Marc Rogers – Telecommunications security expert who called expanded replacement mandates economically unrealistic.
• Markishi Wyatt – Named plaintiff in the proposed class action against Ernst & Young LLP.
• Mary Mack – EDRM chief executive and chief legal technologist, supporting the Buyers Guide’s curation.
• Maxine M. Chesney – U.S. district judge whose March preliminary injunction against Perplexity the Ninth Circuit vacated.
• McKinsey Global Institute – Source of the study tracking 615 companies and the premium on long-term orientation.
• Merck – Party to the NotPetya war-exclusion coverage fight, settled in 2024.
• Meta – Open-weights letter signatory and the named defending party in the U.K. Gormsen matter on AI-assisted disclosure.
• METR – Research nonprofit whose randomized trial found experienced developers 19 percent slower with AI tools.
• Michael Kratsios – White House OSTP director, who alleged Moonshot AI distilled Anthropic’s Fable model.
• Michael Truell – Anysphere chief executive and recipient of the April 2026 letter over Composer 2.
• Microsoft – LinkedIn’s parent, an open-weights letter signatory, and provider of the Azure OpenAI service underpinning Relativity aiR.
• Mike Ernster – Minnesota Department of Public Safety spokesman during the coordinated water system attack.
• Mike Masnick – Techdirt writer who observed that the toolmaker walks while the person who sent the tool inherits the risk.
• Milan D. Smith Jr. – Ninth Circuit judge who wrote the unanimous opinion in the Amazon-Perplexity appeal.
• Minnesota IT Services – Coordinated the state response with federal agencies and counted the systems targeted.
• MIT Project NANDA – Reported that about 95 percent of organizations see zero return on generative AI.
• Moonshot AI – Chinese startup and developer of the Kimi models at the center of the distillation allegations.
• Mozilla – Original signatory of the open-weights letter.
• Naomi Oreskes – Conservation Law Foundation expert whose AI prompts a magistrate judge ordered disclosed.
• Nate – Shopping app whose founder the SEC charged over AI checkout claims allegedly fulfilled by contract workers.
• National Institute of Standards and Technology – Its Center for AI Standards and Innovation produced the DeepSeek security evaluation cited in the Airbnb letter, which tested no Moonshot model.
• National Security Archive – Declassified and released the FBI’s Saddam interview summaries in 2009.
• Nelson Mullins – Law firm urging vendor terms requiring notice when customer data falls under a litigation hold.
• Nick Andersen – CISA acting director, who urged critical infrastructure owners to take exposed controllers off the internet.
• Nike – Maker of the Air Force 1 Low platform used, without affiliation or endorsement, as the customization base.
• Nvidia – Company whose chief executive circulated the open-weights letter, hosted on its servers, and which launched the Open Secure AI Alliance.
• Ona T. Wang – U.S. magistrate judge who ordered OpenAI to preserve and segregate output log data.
• OpenAI – Added its name to the open-weights letter, disclosed the sandbox escape, and is subject to the log preservation order in the Times case.
• Palantir – Original signatory of the open-weights letter.
• Pamir Consulting – Firm whose vice president of intelligence argued the FCC has ample justification to restrict the Chinese carriers.
• Perplexity AI – Defendant-appellant whose Comet Assistant produced the Computer Fraud and Abuse Act appeal.
• Phil Saunders – Relativity chief executive, on claiR as a route straight to the answers in consequential legal data.
• Philip M. Guess – K&L Gates attorney on subpoenas and the Stored Communications Act.
• Ponemon Institute – Conducted the research behind IBM’s 2026 Cost of a Data Breach Report.
• Potomac Law Group – Firm flagging that e-evidence order handling records may draw access requests and civil discovery.
• Presto Automation – Restaurant technology company that settled SEC charges over undisclosed human intervention in its AI ordering.
• Reed Smith – Law firm whose alert framed e-evidence orders as displacing mutual legal assistance for provider-held evidence.
• Reema Holz – DLA Piper colleague of Andrew Peck and co-author of the analysis framing Schulte as extending Da Silva Moore.
• Relativity – Maker of aiR for Review, aiR Assist and claiR, announced Aug. 12 for early 2027 availability.
• RelFest Chicago – Relativity user conference named alongside ILTACON as a demo opportunity where claiR’s open questions could be pressed.
• Rhonda Fischer – New York Supreme Court justice who quashed a subpoena seeking a defendant’s entire ChatGPT account.
• Richard Grubman – Highfields Capital Management managing director whose balance sheet question drew Enron’s famous profanity.
• Rishi Bommasani – Led the Stanford HAI brief that introduced marginal risk to the open-model governance debate.
• Ro Khanna – Ranking member of the House Select Committee on China.
• Rob Robinson – ComplexDiscovery OÜ founder, whose four-jobs marketing framework supplies the sneaker piece’s test question.
• Rockwell Automation – Maker of the Allen-Bradley MicroLogix controllers targeted in the water utility campaign.
• Ron Fabela – Industrial control systems researcher who located exposed Rockwell controllers in a Minnesota city’s public IP space.
• Saddam Hussein – Iraqi ruler who cultivated belief in a destroyed arsenal to deter Iran.
• Salesforce – Platform whose customer environments anchored the 2025 campaign attributed to ShinyHunters-branded clusters.
• Salt Typhoon – Chinese state-linked campaign that reached at least nine U.S. telecommunications companies.
• Sam Altman – OpenAI chief executive, who welcomed the open-weights letter.
• Sarah Heck – Anthropic policy head, who called the alleged Moonshot conduct IP theft and industrial espionage.
• Scott Bessent – Treasury secretary, who said sanctions and Entity List designations would be on the table.
• Securities and Exchange Commission – Brought the early AI-washing settlements and the later Presto Automation and Nate actions.
• Servient – eDiscovery provider arguing that parties who settle AI terms up front retain control over metric confidentiality.
• ShinyHunters – Name used by extortion actors, a brand more than one stable group, under which Ernst & Young was listed on a leak site with a July 31 deadline.
• Shivaram Rajgopal – Co-author of the 2003 survey of financial executives on earnings management.
• Sidley Austin – Law firm tracking protective orders as an emerging point of generative AI dispute.
• Sidney Stein – U.S. district judge who affirmed the OpenAI log preservation order.
• Spencer Fane – Law firm that described the Connecticut expert-prompt order as stayed pending an objection.
• Squire Patton Boggs – Law firm Haslam joined in 2016 as an eDisclosure project manager in its London office.
• Stanford Institute for Human-Centered Artificial Intelligence – Published the governance brief introducing marginal risk to the open foundation model debate.
• Stanford University’s Social Media Lab – Co-producer of the workslop research with BetterUp Labs.
• Suja Viswesan – IBM Security Software vice president, on attackers operating faster and more cheaply with AI.
• Team Telecom – Body whose jurisdiction the House report would widen over private commercial arrangements.
• Tenable – Security vendor whose researchers found the timing and operational pattern consistent with prior CyberAv3ngers activity while stressing that the incident has not been attributed.
• The New York Times – Plaintiff in the copyright case that produced OpenAI’s output log preservation order.
• The Sedona Conference – Source of the three circuit approaches to Rule 34 possession, custody, or control.
• Theranos – Blood-testing company that raised hundreds of millions on claims its device could not meet.
• Thomas O. Farrish – Connecticut magistrate judge who ordered an expert’s AI prompts disclosed under Rule 26.
• Todd Crowder – Named plaintiff who sued LinkedIn in January 2022 in the underlying antitrust action.
• Tony Xu – DoorDash co-founder and chief executive, addressee of the July 31 committee letter.
• K. Competition Appeal Tribunal – Declined to prescribe or forbid AI-assisted review in Gormsen v. Meta Platforms.
• U.S. Court of Appeals for the Ninth Circuit – Vacated the March 9 preliminary injunction and remanded, concluding on a preliminary record that the user, not the operator, is the party doing the accessing, and that Amazon was therefore unlikely to succeed on its CFAA and CDAFA claims.
• U.S. District Court for the Northern District of California – Venue for Schulte v. LinkedIn and for the remanded Perplexity case.
• Unit 221B – Security research firm arguing that payment buys no verifiable deletion.
• William Lazonick – Economist who found 449 S&P 500 companies devoted 54 percent of earnings to buybacks from 2003 to 2012.
• William Wallace Belt Jr. – Of Complete Discovery Source, on the Schulte order answering the proportionality question.
• WilmerHale – Law firm whose alert read Schulte as applying traditional TAR principles to generative AI discovery.
• Wilson Sonsini – Law firm arguing that agent architecture now determines legal outcomes.
• Y Combinator – Original signatory of the open-weights letter.
• Yujin Potter – University of California, Berkeley researcher on the frontier AI offense-defense balance.
• Z.ai – Developer of GLM-5.2, which led the Artificial Analysis open-weight index before Kimi K3’s release.

About ComplexDiscovery OÜ

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals.

Learn more at ComplexDiscovery.com.

Assisted by GAI and LLM Technologies

• An Abridged Look at the Business of eDiscovery: Mergers, Acquisitions, and Investments
• eDisclosure Systems Buyers Guide – Online Knowledge Base

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.