Authored by Tim Rollins, Director of Content Marketing, Exterro

Artificial intelligence is rapidly shifting from an emerging trend to an operational reality across legal practice. While headline-grabbing stories about hallucinated case law and data breaches have raised valid concerns, the path forward doesn't require reinventing the wheel. Even if your organization hasn't mapped out every technical nuance, clear and defensible standards already exist to guide safe adoption.

This practical framework is drawn directly from a recent eDiscovery Today webinar sponsored by Exterro, titled "AI in the Courtroom: How Generative AI Is Changing the Way Legal Teams Go to Court." Hosted by Doug Austin (Editor of eDiscovery Today), the panel brought together top industry experts: Martin Tully (Partner at Redgrave LLP), Kelly Twigger (Principal of ESI Attorneys and CEO of Minerva26), and Bryant Bell (Lead Product Marketer for eDiscovery and AI at Exterro).

Watch the full "AI in the Courtroom" webinar on demand to see how eDiscovery professionals are adapting to AI-powered technology and reducing risk.

Rather than treating AI as an abstract risk or waiting for new regulations to emerge, forward-thinking legal departments are focusing on practical execution. Moving from theoretical discussions to operational implementation requires establishing actionable guardrails that empower teams while safeguarding client data. The following three core guidelines provide a clear roadmap for putting AI into practice safely and defensibly.

1) Manage AI so people are using vetted, reliable tools

The rise of "Shadow AI"—employees independently using consumer-grade chatbots like ChatGPT or Claude for work tasks—is simply shadow IT in a new form. Outright bans are rarely effective and often push usage further out of view. Instead, organizations must proactively establish safe, enterprise-approved pathways for adoption.

Martin Tully uses an urban planning metaphor to illustrate this balance:

‍"I'm going to go to the skate park analogy. When municipalities built skate parks, it was often because there were kids skateboarding, and they were skateboarding in places where it wasn’t safe... Knowing that people were going to skate where they found attractive places to skateboard, they built skateboard parks so that now people could use the park in a safe, in a more contained, and a more controlled environment."

Tully emphasizes that companies need to provide a clear, approved path for AI tools:

‍"Think of it that way. It's going to happen. So companies, smart companies, proactive companies, will provide a path for timely deployment of approved AI tools. They will let people know, if you just give us a few minutes to onboard all this, we're going to let you have all the toys and the bells and whistles... Learn how to skate before you go to the skate park, but then have at it."

Proper governance also requires verifying how vendor models process internal data. Bryant Bell cautions that legal teams must understand how tools interact with company systems:

‍"You really need to understand how that AI works and how it's going to work in the confines of your environments and your systems, and how it's going to interact with your data."

Bell offers a practical diagnostic for testing whether a vendor's tool is truly restricted to internal data or drawing from broader internet sources:

‍"In your legal gen AI system, ask it if a hot dog isa sandwich. And if it can answer that question or gives you different opinions on it, then you probably need to check on whether you have a governed gen AI system or not."

2) Understand what about AI is subject to case law

Courts are actively issuing rulings on AI usage, prompt discoverability, and privilege waivers. Tracking these judicial precedents is essential when negotiating protective orders and conducting Rule 26 meet-and-confers.

Key decisions highlighting these legal boundaries include:

• U.S. v. Heppner: Highlights the risks of unvetted consumer tools. The court determined that voluntarily entering privileged legal information into a public, free-tier chatbot destroyed the reasonable expectation of confidentiality, effectively waiving work-product protection. As Tully notes, "Heppner voluntarily imported presumably privileged legal information into a public free tier AI chatbot. The old rule is, is there a reasonable expectation of confidentiality when you do that? No."
• Morgan v. V2X: Addressed whether confidential discovery materials could be processed using consumer AI. Judge Braswell ruled that confidential documents under a protective order cannot be loaded into a consumer tool unless three conditions are met: the model does not train on the data, third-party disclosure is prevented, and the user retains deletion rights—supported by written terms of service. Kelly Twigger observes: "you can't put information that's confidential under a protective order into a consumer-grade tool..."
• Warner v. Gilbarco: Supported the view that AI functions as a tool rather than a third-party entity, confirming that work-product protections remain intact as long as data isn't exposed to opposing parties or unsecured public systems.
• Tate Group Automotive: Demonstrated how state privilege rules apply to user prompts. Under Texas law, which protects party-to-party communications directly, an executive's prompts into ChatGPT remained privileged—a contrasting result to federal standards.
• Conservation Law Foundation v. Shell Oil Co.: Addressed AI in expert witness workflows, examining whether expert prompts and interaction logs constitute discoverable material or protected work product under Rule 29 agreements.

3) Use common sense and legal fundamentals/best practices

Despite rapid technological advancements, core legal principles, civil procedure rules, and ethical duties remain firmly intact.

Tully references a classic pop-culture line to put the ongoing industry debate into perspective:

‍"I always think of, 'I'm verklempt. Let me give you a topic. Artificial intelligence, neither artificial nor intelligent, discuss.'... AI-generated ESI is still ESI. Relevance and proportionality still apply. The rules of privilege still apply. The rules of evidence still apply. And the ethical obligation of technical competency still applies."

Addressing the issue of AI hallucinations, Tully emphasizes that verifying output is an existing professional standard: ‍

"What we're talking about is not so much a hallucination using some shiny new object. We're talking about is somebody failing to check their work, which has been something that we're required to do for centuries."

This underscores the critical role of maintaining human accountability. Twigger explains:

‍"If you haven't heard the term human in the loop, what that basically means is that you can use AI, but you still have to be paying attention to all the pieces. It's almost the equivalent of using someone to help you draft something, but then it's your responsibility to check everything that's in it and make sure it's valid, that it's well-reasoned, that the cases that are cited are actually referenced."

Rather than constructing entirely new legal frameworks for every software update, Tully advises anchoring strategy in established practice:

‍"I always like to start with, is there a Flintstone way to address Jetsons technology? Because if there is, let's stick with what we know and apply the technology, and we don't have to constantly create new rules."

For a complete breakdown of AI litigation trends and judicial perspectives, watch the AI in the Courtroom Webinar Recording. This recording features the full panel discussion on how legal teams can navigate generative AI while maintaining defensibility in modern litigation.

‍