The record you cannot claim privilege over

I'm Johannes. I have spent eighteen years on the response side of security, and I build tooling that turns evidence into something you can defend. This is part 3 of four on what it takes for AI-assisted analysis to hold up as evidence. Part 2 was about the sentence "nothing found".

A flight recorder is defined in law by who it is for. The EU regulation that the UK kept after Brexit calls it a recorder "installed in the aircraft for the purpose of facilitating accident/incident safety investigations". It is built to be read by someone other than the crew, after the worst day of their lives.

And it comes with its own shield. Cockpit voice and image recordings "shall not be made available or used for purposes other than safety investigation", and in England only the High Court can order one released, and only if it is satisfied that the benefits of disclosure outweigh the harm to this and any future investigation. The record and its protection were designed together, on purpose, because investigators only get honest records if the people being recorded are not handing evidence to the other side.

The AI investigation record has the first half of that design and not the second. Every serious tool now keeps a log of what the agent searched, what came back, and what it set aside. It is easy to assume that log is protected working material. Until August I assumed exactly that. No statute says so. No court in England and Wales has ruled on it. And when I read the doctrine that would have to protect it, I came away thinking the claim is weakest exactly where the record is most worth having.

This post is about why, and what I think follows: build the record to be produced, not hidden. I will also show where my own notes had this wrong.

The case that was the first of its kind

On 22 August 2015 a Hawker Hunter crashed at the Shoreham airshow and eleven people died. Sussex Police wanted the material the Air Accidents Investigation Branch held, and in 2016 the Divisional Court heard what it was told "appears to be the first of its kind to be made in England and Wales".

The aircraft had no flight recorder. It did have two cockpit cameras, fitted voluntarily, "for leisure and private commercial reasons". The court refused to order disclosure of the pilot's statements to the investigators: it was "almost inconceivable" that such statements could properly be ordered out. It ordered the footage disclosed, and the reason it gave is the part worth keeping. The footage was "unlike the cockpit voice and flight data recording which normally has to be created as a matter of legal duty". Nobody had made it for the investigation, so nothing about the investigation's bargain protected it.

That is the lesson I want from aviation. Protection is not a property of a record. It is a decision someone made about a category of record, for a reason, and wrote down. The AAIB's records are protected because Parliament wanted honest investigations more than it wanted the evidence in court. A record that falls outside that decision is just evidence.

The AI record falls outside every decision anyone has written down. So the question is whether ordinary privilege law reaches it.

A tribunal has already described this record

Start with the thing that changed my mind.

In December 2025, ruling on disclosure in Gormsen v Meta, the Competition Appeal Tribunal set out what it expected of a large review. "There needs to be guidance, an audit trail and quality control for the disclosure exercise." And then, at paragraph 210: "There should be a disclosure log for each team member as well as a consolidated disclosure log for the Designated Solicitor. These logs will record what has been reviewed, by whom, and when, any problems and gaps found, lines for follow-up and why certain steps should be or should not be taken."

Read that against an agent's search log. What was reviewed, when, what gaps were found, why a step was or was not taken. That is the record. The Tribunal did not describe it as a hazard a careless team creates. It described it as what a properly run exercise should keep, by hand.

The ruling also records evidence from the class representative's side that the AI "prompt document" is "akin to a review protocol which would be prepared to guide human reviewers in traditional document review". That is the Tribunal summarising a witness, not making a finding. And it reserved a power over the human Disclosure Protocol: Meta need not disclose it now, but "should be ready to disclose it" if the Tribunal later wants sight of it. Nothing later on the case file that I could read mentions AI, prompts or the protocol again. The CAT also runs under its own rules, so none of this binds the Business and Property Courts.

Still, it reframes the question. It is no longer "why did you create this dangerous thing". It is "why would you run an exercise this size without one".

What privilege actually protects

Privilege in England does not protect work. It protects what a document gives away about a lawyer's advice.

The old case is Lyell v Kennedy, in the Court of Appeal in 1884. A solicitor had copied burial certificates and tombstone inscriptions and photographed houses, all public material. The court held his collection privileged, because the very fact of what he had chosen to copy "might shew what his view was as to the case of his client". Bingham LJ later put the rule in one sentence: where the selection of documents a solicitor has copied or assembled "betrays the trend of the advice which he is giving the client the documents are privileged".

That sounds promising for an AI record. An agent's log is a selection, and selection is what Lyell protects. Two later cases close most of that door.

In Sumitomo v Credit Lyonnais (2001), lawyers picked about 5,000 documents, 0.4% of the client's own papers, to be translated for litigation. The Court of Appeal held that Lyell covers a selection of third-party documents, but "it is not authority for the proposition that a selection made from own client documents may similarly attract privilege". In disclosure, the agent is selecting from the client's own documents.

Then Re RBS (Rights Issue Litigation) (2016). Lawyers' notes of interviews were claimed as working papers. Hildyard J accepted that lawyers' working papers are privileged, and then asked what these notes betrayed. To qualify they needed some attribute that "reveals from an evident process of selection the trend of legal advice being given". These did not. And the sentence I keep coming back to: "there is a real difference between reflecting 'a train of inquiry' and reflecting or giving a clue as to the trend of legal advice". The claim failed.

In plain words: a record of what a lawyer looked into is not protected just because a lawyer looked into it. It is protected if it reveals what the lawyer thinks.

Neutral enough to trust, neutral enough to produce

Now put an agent's log next to that test.

A good log is mechanical. It says this query ran over these sources at this time and returned these hits; these were set aside under this stated criterion; this source failed. It is a train of inquiry in the most literal sense anyone has ever built one. And the reason it is worth having, the reason anyone should believe a "nothing found" built on it, is that it does not depend on anybody's view of the case. It is the same record whoever is reading it.

That is the property Re RBS says is not enough. The more neutral the record, the less of the lawyer's advice it betrays, and the weaker the claim that it is a lawyer's working paper. A record neutral enough to trust is neutral enough to produce.

This is my reading of the doctrine, not a holding. No court has applied Re RBS to an AI log, and a judge could find a selection inside one that does betray the trend of advice, particularly in the prompts, which I come back to below. But I do not think the shape of the problem goes away with better drafting. It is what the doctrine protects. A record cannot be trustworthy because it reveals nothing of the lawyer's thinking and privileged because it reveals the lawyer's thinking, at least not in the same lines.

The practitioner who would push hardest on this point has a better objection than "it's ours", so take the objections properly.

"Litigation privilege covers it, ENRC says so"

This is the strongest objection and in some matters it will win.

In SFO v ENRC (2018) the Court of Appeal held that an internal investigation's documents, including lawyers' interview notes, were covered by litigation privilege, because criminal proceedings were reasonably in contemplation and the documents "were brought into existence for the dominant purpose of resisting or avoiding" them. "All the interviews undertaken by Dechert were covered by litigation privilege." An AI investigation run by lawyers once litigation is contemplated sits on the same ground.

Three things limit it. First, the test is dominant purpose, applied to each document. WH Holding v E20 (2018), the same court three months later: "we do not consider that ENRC extended the scope of the documents covered by litigation privilege", and there is "no separate head of privilege" for internal material outside it. A breach investigation is rarely run for one purpose. It feeds the regulator notification, the board, the insurer and the remediation as well as any claim. Second, the litigation must be "adversarial, not investigative or inquisitorial", in Lord Carswell's formulation, which leaves the regulatory fact-finding stage arguable. Third, and this is the engineer's objection rather than the lawyer's: a privilege you argue for each matter, after the fact, on the purpose of each run, is not a property you can build into a system. You find out whether you had it when a judge tells you.

"Run it inside the firm's own environment"

This answers a different question, and I spent months not noticing.

There are two questions wearing one label. The first is waiver: does using the tool destroy confidentiality, and with it privilege? The Upper Tribunal in Munir (promulgated November 2025) observed that putting client letters into "an open source AI tool, such as ChatGPT" waives privilege, and in the same paragraph that "Closed source AI tools which do not place information in the public domain, such as Microsoft Copilot, are available for tasks such as summarising without these risks". It is an observation, not a holding, but on waiver, in-environment deployment is a strong answer.

The second question is methodology: is the record of how the corpus was narrowed something the other side is entitled to test? Where the model runs has nothing to do with that.

The clearest illustration is American. In Conservation Law Foundation v Shell, an expert narrowed the defendants' document production to a working subset with GPT-4o, which her side said was "accessed through Microsoft Azure services via the secure Azure API". In May 2026 a magistrate judge in Connecticut ordered the prompts produced: "An expert witness's methodology is fair ground for discovery, ... and under the facts of this case, the process by which Dr. Oreskes culled down the defendants' document production into a subset to be worked with is an aspect of that methodology." The order does not mention where the model ran. It did not need to.

That order is stayed, and the objection to it is set for argument on 3 November, so it may not survive. But its reasoning is the point: once the record is about how the corpus was narrowed, the hosting arrangement is beside the question.

"US courts protect prompts"

Some do, and it is fair to say the American picture is better for this argument than I have made it sound.

In Tremblay v OpenAI (2024) prompts "crafted by counsel" were protected because they "contain counsel's mental impressions and opinions about how to interrogate ChatGPT". In Warner v Gilbarco (February 2026), a magistrate judge in Michigan held, as an alternative ground, that a litigant's AI materials were work product and not waived, because "ChatGPT (and other generative AI programs) are tools, not persons". And in Villanueva v LVMPD (September 2026), a district judge in Nevada set aside an order to produce an expert's whole ChatGPT history: the outputs were "facts or data" and had to go over, but "a question is not something that an expert can 'consider' or 'rely' upon", so the prompts stayed protected. That sits awkwardly next to CLF v Shell, and it does not cite it.

The other direction is just as real. In United States v Heppner (February 2026), Judge Rakoff held that a defendant's exchanges with a public AI tool, which was Claude, were neither privileged nor work product, because they "were not prepared at the behest of counsel and did not disclose counsel's strategy".

Two things follow for England. The cases split along the old lines, who made the material, for whom, and who else saw it, not on anything particular to AI. And England has no general work-product doctrine of the American kind. The nearest equivalent is litigation privilege, with the limits above. An American court protecting a lawyer's prompts tells you little about whether an English court would protect a machine's log.

"Then don't keep the log"

This is the one people say quietly, and it is the expensive option.

The Bar Standards Board's guidance, in force since May 2026, tells barristers to "keep proper records (rC87.2), which may include AI audit logs and appropriate prompt histories". The CAT has said what a disclosure log should contain. Practice Direction 57AD requires parties to "take reasonable steps to preserve documents in its control that may be relevant to any issue in the proceedings", so a log that exists is not yours to tidy away once a dispute is live.

And there is a case about what happens when the method is not written down. In Triumph Controls v Primus (2018), a party used computer-assisted review to set aside 220,000 documents, which "was not at any time discussed with the defendants, let alone agreed with them", and validated the cut-off by sampling. The court found "no information as to precisely how that sampling exercise was conducted. There are, for example, no stated tolerances". The exercise "cannot be described as transparent, and cannot be said to be independently verifiable". It ordered a manual review of a 25% sample.

Ireland's High Court said the same thing three years earlier, approving technology-assisted review in IBRC v Quinn (2015): because it "combines man and machine, the process must contain appropriate checks and balances which render each stage capable of independent verification".

That is what not keeping the record costs. You do not avoid the argument about your method. You lose it.

"A producible record hands them every dead end"

This is the objection that actually worries litigators, and it deserves a straight answer.

Yes. A complete record shows the hypotheses that went nowhere and the searches that came back empty. Opposing counsel will read them. Some will try to make a dead end look like a cover-up.

But look at what the alternative hands them. A "nothing found" with no record behind it is a sentence they are invited to disbelieve, and part 2 of this series was about how little most of those sentences can bear. An empty search with a record is evidence that you looked. An empty search without one is a gap they get to fill.

And the dead ends are not where the advice is. The advice is in what a lawyer concluded from them. That suggests the design I would defend: keep the mechanical record of what ran, over what, with what result, as one layer, built to be produced. Keep the lawyer's reading of it, the annotations and the theory of the case, as another, where on my reading the claim to working-paper privilege is at its strongest, because that is the part that betrays the trend of advice. Do not mix them in one document and then hope a judge separates them for you.

The rule is being written by a committee

The other reason to design for production is that someone is about to write the rule, and it will probably not be a judge.

The Civil Justice Council's interim report, in February 2026, said what the open question is: AI in disclosure "is likely to give rise to its own particular issues (including the extent to which the disclosure of prompts, together with the testing and refinement of those prompts, and the sample documents on which the prompts were tested, is required)". It also said, in the same paragraph, that it was "not aware of any case in which there has been a dispute which has required intervention from the court". Its final report is due later this year.

The Disclosure Review Working Group surveyed 215 practitioners on PD57AD, and its July 2026 summary lists the reform themes respondents raised: "adapting PD57AD to developments in TAR and AI, revising section 2 of the DRD, clarifying whether AI falls within TAR, addressing prompts and validation, requiring appropriate transparency". Those are the respondents' themes, not the Group's proposals. The Group "hopes to be able to consult on a series of recommendations later this year or early in 2027". The Civil Procedure Rule Committee has set up a sub-committee on AI, which has said it does not assume AI-specific rules will follow. Across the water, the Irish High Court's practice direction on generative AI, in operation since September, already lists among its warnings that information entered into these tools "(including search results) may be required to be disclosed in legal proceedings".

When that consultation opens, the people building these tools can either argue for a record that is hidden, or show one that is ready to be produced. I know which argument I would rather make.

What "built to be produced" means

Concretely, three properties, offered for criticism.

1. Layers that do not leak. The machine record (queries, sources, results, exclusions with their stated criteria, failures) is one artefact. Lawyer commentary is another, linked to it but never written into it. You can produce the first without producing the second.

2. Recomputable by a stranger. From the record alone, a third party can recompute what was searched, what was not, and what the denominator was, without trusting the tool's summary of itself. This is the property Triumph found missing: "independently verifiable".

3. Integrity, not correctness. A signature on the record proves it has not changed since it was made. It proves nothing about whether the conclusions are right, and it should say so. A record that overclaims is worse than none, because it will be read as a certificate.

Where my own work stops

I am not a lawyer, and nothing here is legal advice. It is an engineer reading the cases that his product's record would be argued under. Every position above could be overturned by one first-instance case management decision, and most of those are never published.

No English court has ruled on any of this. The Find Case Law search I ran on 20 October 2026 found nothing from late August to today, but it does not cover the County Court or the CAT. Gormsen is a tribunal, under its own rules. Lyell v Kennedy and the Bingham LJ sentence I read as quoted in Sumitomo and Re RBS, not in the original reports.

I build a tool that makes exactly this record. No record from it has been produced in proceedings or tested by an opponent. Until one is, the design above is a bet, not a result.

And my own notes had this wrong. In August I kept a register of the objections litigators would raise. Against "your log of discarded hypotheses is a disclosable document", the answer I wrote was that litigation privilege over investigation working papers plus in-environment confidentiality "should protect it". The second half answered the waiver question when I had been asked the methodology question. The first half rested on a privilege that Re RBS makes much weaker than I assumed. A research pass a few days later caught both. That is part 1 of this series again: a plausible sentence written once and read back as if it were settled.

The unsolved problem

The layers do not separate cleanly at the prompt.

A prompt is the lawyer's view of the case. The evidence summarised in Gormsen described the prompt document as one which "describes the case and defines the different criteria the AI should apply to identify relevant documents". That is about as close to Lyell v Kennedy as a modern document gets: a selection that shows "what his view was as to the case of his client". It is also the specification of the search. Without it, nobody can rerun what was done or say why a document was set aside.

One court has already drawn a line here, and on the opposite side from where a record needs it. Villanueva protected the questions and produced the answers. For a record of a search, the questions are the method.

Produce it and you hand over your theory of the case. Withhold it and the record is no longer recomputable, which was the point of keeping it. I do not know how to build a record that gets both, and I do not think the doctrine as it stands tells us which side wins. The CJC named exactly this question in February. I expect the working group to answer it before any court does.

If you have argued a version of this at a case management conference, or you know of a protocol that solved it, I want to hear about it, and I will correct this post.

What to take from this

• Protection is a decision about a category of record, not a property of a record. Aviation made that decision. Nobody has made it for AI logs.
• English privilege protects what a document betrays of a lawyer's advice, not the work that went into it.
• A train of inquiry is not the trend of advice. A neutral machine log is the purest train of inquiry ever built.
• A record neutral enough to trust is neutral enough to produce.
• In-environment deployment answers waiver. It does not answer methodology.
• Not keeping the record does not avoid the argument about your method. It loses it.

Building investigation records meant to be checked by someone who does not trust you is the problem I work on during the day: that work is here.

---

Sources

• Flight recorder defined by investigative purpose; cockpit recordings not to be used other than for safety investigation; the court's benefits test: Regulation (EU) No 996/2010 (as retained), Articles 2(6) and 14. https://www.legislation.gov.uk/eur/2010/996/article/14
• High Court as the gateway for release in England and Wales: Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 2018 (SI 2018/321), reg 25. https://www.legislation.gov.uk/uksi/2018/321
• Shoreham: "first of its kind", AAIB statements refused, cockpit footage disclosed because not created under a legal duty: Chief Constable of Sussex Police v Secretary of State for Transport and BALPA [2016] EWHC 2280 (QB), paras 1, 7, 41, 48-50, 55. https://caselaw.nationalarchives.gov.uk/ewhc/qb/2016/2280
• Audit trail and the disclosure log at para 210; Disclosure Protocol reservation at para 208; prompt document as summarised from witness evidence at para 224(2); AI review not "experimental" at para 242: Gormsen v Meta Platforms Inc [2025] CAT 85, Ruling (Disclosure), 16 December 2025. https://www.catribunal.org.uk/cases/14337722-dr-liza-lovdahl-gormsen
• A solicitor's selection privileged where it "betrays the trend of the advice": Lyell v Kennedy (No 3) (1884) 27 Ch D 1, 25-26, and Bingham LJ in Ventouris v Mountain [1991] 1 WLR 607, 615, both as quoted in the two judgments below.
• Lyell does not extend to a selection from the client's own documents: Sumitomo Corp v Credit Lyonnais Rouse Ltd [2001] EWCA Civ 1152, paras 7, 53, 72. https://www.bailii.org/ew/cases/EWCA/Civ/2001/1152.html
• "A train of inquiry" versus "the trend of legal advice"; working-papers claim fails: Re RBS (Rights Issue Litigation) [2016] EWHC 3161 (Ch), paras 99, 105, 126, 196. https://caselaw.nationalarchives.gov.uk/ewhc/ch/2016/3161
• Investigation interviews covered by litigation privilege on dominant purpose; Lord Carswell's three conditions quoted at para 64: Director of the SFO v Eurasian Natural Resources Corp [2018] EWCA Civ 2006, paras 64, 119-120. https://caselaw.nationalarchives.gov.uk/ewca/civ/2018/2006
• ENRC did not extend litigation privilege; no separate head for internal material: WH Holding Ltd v E20 Stadium LLP [2018] EWCA Civ 2652, paras 18, 27. https://caselaw.nationalarchives.gov.uk/ewca/civ/2018/2652
• Open-source tools waive privilege, closed tools "without these risks": UK and R (Munir) v SSHD [2026] UKUT 81 (IAC), para 21, promulgated 17 November 2025. https://caselaw.nationalarchives.gov.uk/ukut/iac/2026/81
• Expert's culling prompts discoverable methodology "under the facts of this case": Conservation Law Foundation v Shell Oil Co., No. 3:21-cv-00933 (D. Conn.), ECF 970 (text order, 18 May 2026); stayed, objection set for argument 3 November 2026 (ECF 1015). GPT-4o via "the secure Azure API" from the parties' filings, ECF 976 at 3. https://www.courtlistener.com/docket/60042265/conservation-law-foundation-inc-v-shell-oil-company/
• Prompts "crafted by counsel" contain "mental impressions": Tremblay v OpenAI, No. 23-cv-03223-AMO (N.D. Cal.), ECF 167 (8 August 2024), 3. https://storage.courtlistener.com/recap/gov.uscourts.cand.414822/gov.uscourts.cand.414822.167.0_1.pdf
• AI programs "are tools, not persons"; work product not waived (alternative holding): Warner v Gilbarco, No. 2:24-cv-12333 (E.D. Mich.), ECF 94 (10 February 2026), 10-12. https://storage.courtlistener.com/recap/gov.uscourts.mied.379552/gov.uscourts.mied.379552.94.0.pdf
• Expert prompts protected, outputs produced as "facts or data": Villanueva v Las Vegas Metropolitan Police Department, No. 2:24-cv-00125-ART-DJA (D. Nev.), ECF 112 (29 September 2026), 6-10. https://storage.courtlistener.com/recap/gov.uscourts.nvd.166491/gov.uscourts.nvd.166491.112.0_1.pdf
• Public AI tool use neither privileged nor work product: United States v Heppner, No. 25-cr-00503 (S.D.N.Y.), ECF 27 (memorandum 17 February 2026), 2, 12. https://storage.courtlistener.com/recap/gov.uscourts.nysd.652138/gov.uscourts.nysd.652138.27.0.pdf
• TAR must be "capable of independent verification": Irish Bank Resolution Corporation v Quinn [2015] IEHC 175, para 68. https://www.bailii.org/ie/cases/IEHC/2015/H175.html
• "(including search results) may be required to be disclosed": High Court of Ireland, Practice Direction HC 142, Responsible Use of Generative AI in Court Documents, para 10, in operation 1 September 2026. https://www.courts.ie/practice-directions/full-practice-direction?url=practice-direction-on-the-responsible-use-of-generative-artificial-intelligence-in-court-documents
• Barristers to keep "AI audit logs and appropriate prompt histories": Bar Standards Board, Guidance on the use of Artificial Intelligence and Other Technologies, valid from 18 May 2026. https://www.barstandardsboard.org.uk/asset/5E1BAA5C%2D614C%2D4105%2DAFAE9A9CCDF8D97B/
• Duty to preserve, para 3.1(1); no mention of artificial intelligence: Practice Direction 57AD. https://www.justice.gov.uk/courts/procedure-rules/civil/rules/part-57a-business-and-property-courts/practice-direction-57ad-disclosure-in-the-business-and-property-courts
• Undiscussed CAR cut-off, undocumented sampling, "independently verifiable", 25% manual review: Triumph Controls UK Ltd v Primus International Holding Co [2018] EWHC 176 (TCC), paras 10, 29, 31, 42. https://caselaw.nationalarchives.gov.uk/ewhc/tcc/2018/176
• Disclosure of prompts as the open issue; "not aware of any case": Civil Justice Council, Interim Report and Consultation, Use of AI for Preparing Court Documents, February 2026, para 6.1. https://www.judiciary.uk/wp-content/uploads/2026/02/Interim-Report-and-Consultation-Use-of-AI-for-Preparing-Court-Documents-2.pdf
• Respondents' reform themes, "addressing prompts and validation, requiring appropriate transparency"; consultation hoped for late 2026 or early 2027: Disclosure Review Working Group, PD57AD working party update, July 2026. https://www.judiciary.uk/wp-content/uploads/2026/07/PD57AD-Working-Party-Summary-July-2026.pdf
• AI sub-committee, no assumption of AI-specific rules: Civil Procedure Rule Committee, minutes of 8 May 2026. https://assets.publishing.service.gov.uk/media/6a31bf78c6e94f095f3ef8f7/cprc-8-may-2026-minutes.pdf