Editor’s Note: Two prominent voices in technology-assisted review have staked out a position on a question federal courts are only beginning to confront: whether the prompts attorneys feed to generative AI review tools must be shared with the other side. Tara Emory and Maura Grossman argue in a paper forthcoming in the Columbia Science and Technology Law Review that well-developed prompts carry an attorney’s factual investigation, case theories, and knowledge of sensitive nonresponsive material, and that routine compelled disclosure would degrade production quality for both parties.
For cybersecurity, data privacy, regulatory compliance, and eDiscovery professionals, the paper lands amid a wave of 2026 decisions on AI prompts, privilege, and protective orders, including orders restricting public AI tools across entire discovery corpora.
Watch for the first contested motion to compel GenAI TAR prompts in a merits case; the framework proposed here, validation and preservation instead of disclosure, is likely to shape how responding parties brief it.
Content Assessment: Prompt privacy: new scholarship argues GenAI review instructions are attorney work product
Information - 94%
Insight - 95%
Relevance - 94%
Objectivity - 92%
Authority - 94%
94%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Prompt privacy: new scholarship argues GenAI review instructions are attorney work product."
Industry News – eDiscovery Beat
Prompt privacy: new scholarship argues GenAI review instructions are attorney work product
ComplexDiscovery Staff
The instructions attorneys type into generative AI review tools may soon rank among the most fought-over text in civil litigation. A new paper from two prominent eDiscovery and technology-assisted review authorities argues that courts should treat those prompts as protected attorney work product, not as search terms to be handed across the table.
Tara S. Emory and Maura R. Grossman posted “GenAI Prompts in eDiscovery: Protected Work Product or Not?” to SSRN on July 1. The 26-page article, forthcoming in the Columbia Science and Technology Law Review in December 2026, contends that prompts refined against a live document population can capture “precisely what the work-product doctrine has long sought to protect, including an attorney’s factual investigation, mental impressions, and case strategy,” the authors wrote.
The credentials behind the argument matter. Emory is principal of Aligned Discovery PLLC, a court-appointed neutral, and a member of the Sedona Conference AI Working Group Steering Committee. Grossman, a research professor in the University of Waterloo’s David R. Cheriton School of Computer Science and principal of Maura Grossman Law, serves as special master for electronically stored information disputes in the hair relaxer multidistrict litigation in the Northern District of Illinois, a proceeding that entered a stipulated generative AI review protocol in April.
Why prompts are not search terms
In generative AI technology-assisted review, which the authors call GenAI TAR, attorneys write natural-language instructions telling a large language model what makes a document responsive or nonresponsive. Because effective prompts must be tested against the actual review population, refined, and retested, they accumulate detail with every iteration: facts learned from witness interviews, theories about what evidence proves a claim, and descriptions of nonresponsive material the attorney wants filtered out.
That accumulation separates prompts from keywords. Courts have routinely ordered parties to exchange search terms, reasoning in cases such as Romero v. Allstate Insurance Co. that terms go to “the underlying facts of what documents are responsive” rather than the thought processes of counsel. Attorney document selections have fared differently. In Sporck v. Peil, the Third Circuit held in 1985 that grouping documents to prepare a witness was protected because the selection would reveal counsel’s mental impressions. Emory and Grossman argue prompts may deserve stronger protection than the seed sets debated a decade ago because a well-developed prompt states the attorney’s rationale in plain language rather than leaving it implied.
The paper also revives a debate that technology had quieted. When continuous active learning workflows, often called TAR 2.0, replaced discrete training sets, courts observed there was often no seed set left to disclose. GenAI TAR typically returns to a TAR 1.0 structure built on fixed, attorney-crafted instructions, and the disclosure question returns with it.
Courts have started drawing lines
The argument does not arrive on a blank slate. In Tremblay v. OpenAI, Inc., the U.S. District Court for the Northern District of California held in August 2024 that prompts used by plaintiffs’ counsel to test ChatGPT were opinion work product because they “were queries crafted by counsel and contain counsel’s mental impressions and opinions about how to interrogate ChatGPT.” In Concord Music Group, Inc. v. Anthropic PBC, the same district agreed in May 2025 that attorney-crafted prompts were opinion work product, though it found the publishers waived protection over portions of a post-suit investigation they had placed at issue.
Decisions have multiplied in 2026, and they do not all point the same direction. The Southern District of New York held in United States v. Heppner that a criminal defendant’s exchanges with a public chatbot, conducted without counsel’s direction, carried no protection at all. Courts reached the opposite result on civil facts in Warner v. Gilbarco, Inc. in the Eastern District of Michigan and Morgan v. V2X, Inc. in the District of Colorado, with the Warner court reasoning that generative AI programs are “tools, not persons,” so submitting litigation materials to one does not waive work product. And in Conservation Law Foundation v. Shell Oil Co., a Connecticut magistrate judge ruled in May that an expert witness’s prompts are discoverable as methodology under Rule 26, a ruling now stayed pending resolution of a Rule 72(a) objection before the district court.
The prompt question also intersects with data security. In Jeffries v. Harcros Chemicals, Inc., the District of Kansas amended a protective order in March to bar public generative AI tools from touching any discovery material, confidential or not, citing the practical impossibility of clawing data back from a model once submitted. For information governance and security teams, the message is that tool selection and contractual data-retention terms now belong in protective order negotiations, not in post-dispute cleanup.
Melissa Weberman and L. Michel Marchand, eDiscovery attorneys at Arnold & Porter, wrote in a May 19 analysis that the emerging framework “turns less on the technology and more on who created the prompts, for what purpose, and under what terms of service.” Attorney-crafted prompts in service of litigation strategy sit at the most protected end of that spectrum, exactly where GenAI TAR prompts would fall.
A staffing fraud hypothetical shows the stakes
The paper’s most practical contribution may be a worked example. In a hypothetical healthcare staffing fraud case, defense counsel begin with a prompt that simply restates the plaintiff’s document request. Testing reveals the gaps. An email offering quiet encouragement to an employee named Marcus Chen means nothing to the model until counsel, drawing on witness interviews, adds an instruction to include communications supporting Chen’s challenges to management. A routine-looking margin directive from the chief financial officer becomes responsive only after counsel add language reflecting their theory that pressure to improve margins without cutting revenue can signal billing fraud. A third refinement excludes correspondence about an unrelated equipment vendor’s financial troubles, information that is confidential, nonresponsive, and commercially sensitive.
The authors tested each prompt against a generative AI review system, with results reproduced in the paper. Their analysis sorts the three refinements into fact work product, opinion work product, and confidential third-party information, and notes that in every case the underlying responsive documents still reach the requesting party. What disclosure of the prompts would add, they argue, is a map of the producing party’s interviews, theories, and vulnerabilities.
Validation, not disclosure, as the transparency tool
The alternative the authors advance is outcome-based. Statistical sampling, properly calculated recall and precision, and qualitative review of what a search missed can demonstrate production adequacy without exposing attorney reasoning. The paper points to the stipulated protocol entered in April 2026 with defendant RNA Corporation in the hair relaxer litigation, negotiated with Grossman’s assistance as special master. That protocol requires production of relevant documents from the LLM-coded and seed sets, categorical descriptions of nonresponsive documents, blind review of a stratified sample of at least 2,500 documents, recall reporting with 80 percent estimated recall as a presumptive benchmark, and preservation of all final prompts in case deficiencies later surface.
Preservation matters to the framework. Prompts remain available for in camera review by a judge, neutral, or special master if performance metrics reveal material deficiencies or suggest intentional bias, a narrow exception the authors accept. Requiring disclosure as a routine matter, they warn, would push producing parties toward generic prompts that mirror document requests, weaker recall and precision, and thinner productions that hurt both sides. The dynamic echoes what practitioners once called the TAR tax, the disclosure demands that deterred parties from using predictive coding at all.
What practitioners should do now
The paper reads as a playbook as much as an argument. Producing parties using GenAI TAR should test and refine prompts against the review population rather than negotiating untested language, document the validation process, and preserve final prompts and validation scores against later challenge. Parties inclined to share prompts voluntarily, a choice the authors encourage when it reduces disputes, should first secure a Federal Rule of Evidence 502(d) order so disclosure does not work a broader subject-matter waiver, and should wait until prompts are near final before committing. Requesting parties, for their part, get further by pressing for sound sampling protocols and recall metrics than by fighting for prompt text they cannot test.
Not everyone will accept the bargain. Courts encouraged expansive transparency when predictive coding was new, and judges skeptical of a novel technology may again prefer disclosure to statistics, particularly where trust between parties is thin. The paper concedes that a prompt parroting a document request earns no protection, and that the line between topic and theory will be drawn prompt by prompt, likely in camera. Fact work product embedded in prompts also remains reachable on a showing of substantial need.
The doctrinal anchor, though, is 79 years old. Hickman v. Taylor warned in 1947 that without a zone of privacy, “much of what is now put down in writing would remain unwritten.” Emory and Grossman’s closing argument is an updated version of the same point: attorneys who expect their prompts to be disclosed will write worse ones, and both sides will receive weaker productions as a result.
As GenAI TAR moves from pilot projects to production workflows, the prompt-disclosure fight is likely to move from scholarship and protocols into contested discovery motions. The first rulings will help determine whether courts treat prompts more like search terms, seed sets, or attorney work product in their own right.

News Sources
- GenAI Prompts in eDiscovery: Protected Work Product or Not? (SSRN)
- The Emerging Framework on AI Prompts, Privilege, and Discovery (Arnold & Porter eData Edge)
- Federal Courts Issue Diverging Rulings on the Use of Generative AI in the Context of Privilege, Work Product and Protective Orders (Akin Gump)
- Court Protects AI Prompt Testing as Work Product in Copyright Suit (Akin Gump AI Law and Regulation Tracker)
- Generative AI Prompts as Attorney Work Product: Court Limits Discoverability but Finds Waiver in Concord v. Anthropic (CODISCOVR)
- Discovery and Potential Privilege of Generative AI Prompts (Greenberg Traurig eDiscovery Watch)
- Case Management Order No. 12: Appointment of Special Master, In re Hair Relaxer Marketing Sales Practices and Products Liability Litigation, MDL No. 3060 (U.S. District Court, N.D. Ill., via Nigh Goldenberg Raso & Vaughn)
Assisted by GAI and LLM Technologies
Additional reading
- EDRM opens public comment on EDRM 2.0, inviting the profession to redraw its own map
- EDRM expands IGRM v4.1 guidance for AI-era information governance
- An Oxford tutorial for cybersecurity, governance and eDiscovery
- Estonia aims to be first to give AI agents official digital IDs
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more understandable for practitioners, policymakers, and business leaders.































