On October 21, 2026, a federal magistrate judge in the Southern District of Florida issued a discovery order that treats a litigant’s conversations with AI tools as material a court can order produced. The case is Fontainebleau Florida Hotel, LLC v. Botach, No. 1:25-cv-20251. The order is titled Second Order After Discovery Hearing. The District Court had authorized only discovery limited to damages, and the order resolves disputes over the plaintiff’s requests for the defendant’s AI communications and over proposed subpoenas to four AI service providers.
These are discovery rulings. They are not findings of liability, and neither order finds spoliation. This column is not legal advice, so ask counsel about your own preservation obligations.
What the court allowed and what it refused
The plaintiff asked for the defendant’s AI communications since December 3, 2024 in several categories. The court allowed subpoenas under Rule 45 to the four providers limited to three subjects: the hotel, counsel for the plaintiff, and any employee, owner, or representative of the hotel. It sustained the defendant’s objections to the broader requests. The request for every AI communication about the litigation was found overbroad, and the requests about court orders and judicial officers were also limited out.
The plaintiff argued that the AI exchanges may reveal the extent of alleged malice, the intent behind the conduct, and whether an exception to Florida’s punitive-damages cap applies. The court agreed that prompts can matter. It reasoned that those communications may show the purpose for which a statement was created, the instructions supplied, and the effects sought. The court held that the communications relate closely enough to the disputed damages issues to warrant discovery, and it left open whether they will establish malice or specific intent.
The defendant also argued work-product protection. The court declined to treat AI communications as categorically protected. It found that independently generated AI communications do not automatically become protected work product merely because counsel represents the user, and it noted that the doctrine can reach materials prepared by or for a party, not only by counsel. Specific claims remain available. Where the defendant withholds material on a work-product claim, the order requires a privilege log identifying what is withheld and the grounds.
A different court looked at a different setting. In Villanueva v. Las Vegas Metropolitan Police Department, a district judge’s September 29, 2026 order sorted an expert’s ChatGPT history log. The case summaries ChatGPT returned that the expert considered must be disclosed, while the expert’s prompts, a deposition outline, and draft-report material are protected. The setting is expert disclosure, so it supports a narrower point: courts are reading AI histories closely and sorting them item by item, and not everything a person typed is reachable.
Deletion logs enter the dispute
The order also touches deletion. One subpoena category sought AI communications that had been deleted since creation. The court limited that category to deleted communications within the three allowed subjects. It recorded the plaintiff’s explanation that it wanted provider records because of concerns that the defendant may have deleted or failed to preserve responsive AI communications. The order reports that concern and does not decide it.
The October order declined to compel the defendant to sign consents authorizing the providers to disclose records, pointed the plaintiff to ordinary Rule 45 subpoenas, and stated that it does not compel a nonparty provider to produce anything. The question came back two weeks later. In an Order After Discovery Hearing entered November 6, 2026, the court recorded the plaintiff’s representation that the AI service providers keep deletion logs for accounts but require the account holder’s consent before releasing them. The defendant represented that he had obtained account data from ChatGPT and Grok and given it to an electronic-discovery vendor for review.
The court ordered the defendant to finish producing responsive, nonprivileged AI communications and to provide written consent authorizing the providers to disclose records showing whether communications were deleted from his accounts during the relevant two-year period. The order says that consent “is limited to the disclosure of deletion logs.” It also says the court “makes no finding that Defendant deleted responsive communications or engaged in spoliation at this time.” The court ordered consent so that whether something was deleted can be checked, in addition to what was said. The order set a continued hearing for November 9 if a provider found the limited consent insufficient.
For context on preservation, Federal Rule of Civil Procedure 37(e) addresses electronically stored information that should have been preserved in anticipation or conduct of litigation and is lost because a party failed to take reasonable steps, when the information cannot be restored or replaced through additional discovery. Under the rule’s text, the harshest measures, such as an adverse presumption or dismissal, require a finding of intent to deprive. Nothing in the Fontainebleau order applies that rule. It is background for why the timing of a deletion matters.
Where Responsible AI ends and AI Governance begins
Responsible AI is the machine checking the machine. Automated retention schedules, audit logging, and data-loss filters that flag a pasted contract or a customer list all belong here. They are valuable and necessary, and they work well where an output can be reversed. A deletion that a court later reads as lost evidence is hard to reverse.
Three decisions sit outside any filter. Which AI accounts and conversations count as business records? Who issues a litigation hold that reaches AI accounts? May a deletion go forward once a dispute is foreseeable? No filter answers those questions. They are AI Governance decisions. AI Governance requires a named human with authority deciding at a checkpoint, and that person records accept, modify, or reject.
The Fontainebleau orders sorted material by subject and by privilege claim, and they left the provider-held records to subpoenas and consent. A retention tool cannot tell whether a personal AI account used for work is a business record, or whether a chat about a customer dispute falls inside a hold. A named person has to make that call and sign it.
Organizations should also hold their own account of how AI-assisted decisions were made before a court asks. HAIA-CARCS, the Compliance Accountability Record and Case Study, is a structured documentation protocol that turns the raw evidence of AI work sessions into an organized record suitable for internal review and external audit. It gives the organization its own account to set beside a provider’s logs.
Actions, owners, and measures
- Inventory. The security or IT lead, with each department head, lists every AI account and tool in use, including personal accounts used for work.
- Records owner. The general counsel or chief compliance officer names one person with authority to decide what counts as a business record.
- Hold template. Counsel adds AI providers and chat histories to the litigation-hold template.
- Signed decision per account. The records owner records accept, modify, or reject for each account, with name, date, and reason, as a hold or a release.
- Automation follows the decision. IT suspends auto-deletion on held accounts and logs the suspension. This is the Responsible AI part, and it executes what the named person decided.
- Own accountability record. The records owner keeps a record of AI-assisted decisions, and counsel reviews it before a dispute.
Two measures tell you whether this works. The first is the share of AI accounts covered by the records inventory. The second is the time from the point litigation becomes reasonably foreseeable to a signed hold that covers AI accounts, since a formal dispute notice can arrive after the duty to preserve begins. The records owner sets the targets and reports both to leadership each quarter.
Sources
- Fontainebleau Florida Hotel, LLC v. Shmuley Boteach Jacob a/k/a Shmuel Botach, et al., No. 1:25-cv-20251 (S.D. Fla. Oct. 21, 2026) (Second Order After Discovery Hearing, ECF No. 289) (Elfenbein, M.J.). https://storage.courtlistener.com/recap/gov.uscourts.flsd.682106/gov.uscourts.flsd.682106.289.0.pdf
- Fontainebleau Florida Hotel, LLC v. Shmuley Boteach Jacob a/k/a Shmuel Botach, et al., No. 1:25-cv-20251 (S.D. Fla. Nov. 6, 2026) (Order After Discovery Hearing, ECF No. 322) (Elfenbein, M.J.). https://storage.courtlistener.com/recap/gov.uscourts.flsd.682106/gov.uscourts.flsd.682106.322.0.pdf
- Villanueva v. Las Vegas Metropolitan Police Department, No. 2:24-cv-00125 (D. Nev. Sept. 29, 2026) (Order, ECF No. 112) (Traum, J.). https://docs.justia.com/cases/federal/district-courts/nevada/nvdce/2:2024cv00125/166491/112
- Federal Rules of Civil Procedure, Rule 37, Failure to Make Disclosures or to Cooperate in Discovery; Sanctions (Legal Information Institute, Cornell Law School, republishing the rule text). https://www.law.cornell.edu/rules/frcp/rule_37
FAQ
Does the Fontainebleau order find anyone liable or find that evidence was destroyed?
No. The order resolves discovery disputes in a damages-only phase. The October order records the plaintiff’s concern that AI communications may have been deleted, and the November 6 order, which required consent for providers to release deletion logs, states that the court makes no finding of deletion or spoliation. It is not a liability ruling.
What did the court allow the plaintiff to seek from AI providers?
The court allowed Rule 45 subpoenas to four AI service providers, limited to AI communications since December 3, 2024 about the hotel, counsel for the plaintiff, or any employee, owner, or representative of the hotel. The order says it does not compel any nonparty provider to produce information.
Are conversations with AI tools protected as work product?
The court held that work-product protection does not categorically cover a litigant’s AI communications. A party who withholds material must support the claim and provide a privilege log. Whether a specific conversation is protected depends on the facts, so ask counsel.
Does this mean every AI chat is discoverable?
No. The court sustained objections to requests for all communications about the litigation, court orders, and judicial officers. It allowed discovery only for subjects tied to the damages issues. Each case turns on its own scope and relevance.
What is the difference between Responsible AI and AI Governance in a records dispute?
Responsible AI is the machine checking the machine, such as retention settings, logging, and data-loss filters. AI Governance requires a named human with authority to decide, and to record accept, modify, or reject. Deciding what is a business record and whether a deletion may proceed after a dispute is foreseeable is an AI Governance decision.
What should an organization do first?
Inventory AI accounts and tools in use, including personal accounts used for work, and name one records owner. Then add AI providers and chat histories to the litigation-hold template and record a signed hold or release decision per account. Track the share of accounts inventoried and the time from the point litigation becomes reasonably foreseeable to a signed hold.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply