Firm workflow
Questions to ask before connecting discovery to an AI tool
Understand where files go, who can access them, and what happens after processing before connecting a live case.
On this page
Before connecting discovery to an AI tool, establish what data it receives, where copies are stored, who can access them, and what happens when the firm stops using the service. A short security slogan is not enough to answer those questions.
This guide is an evaluation aid. It does not determine whether a particular service is appropriate for a particular client matter or replace review of the service’s current terms.
| Area | Question to ask |
|---|---|
| Copies | Which files, extracted text, transcripts, and temporary files are stored, and where? |
| Providers | Which services receive documents, audio, images, or results, and under what terms? |
| Access | Who can add members, grant case access, download results, and remove access? |
| Retention | What is deleted on request, and what may remain in records or backups? |
| Oversight | Who in the firm checks quotations, summaries, and incomplete coverage? |
What leaves the original folder?
A connection can preserve the originals while still creating copies for processing. Ask which files are copied, whether extracted text or transcripts are retained, and where results are stored. Include temporary processing files in the question.
Check the scope of the connection itself. Does the workflow select one case folder, and how can the firm confirm which material was included? Use a synthetic sample while learning the workflow.
Which services handle the material?
Ask which providers receive documents, audio, images, or generated results. Establish whether the answer varies with the processing mode. Check the current applicable terms for training use, retention, human access, and subprocessors rather than assuming one promise covers every service involved.
A “not used for training” statement answers one question. It does not, on its own, mean no copies are kept, no third parties process the files, or that data is deleted immediately.
How does the firm control access?
Test the workflow with more than one role. Establish who can add team members, grant access to a case, download results, and remove access. Ask how support access works and how the firm can report an access concern.
Be specific about case restrictions. A separate firm workspace and restricted access within that firm serve different purposes. Your evaluation should account for both.
What happens after review?
Ask how to export work, request deletion, and understand any retained records or backups. Distinguish disconnecting a storage account from deleting previously copied material. Request a clear answer about what is removed and what may remain.
Record the date and version of the documentation reviewed. If the product is in beta, identify which answers are current behavior and which are planned changes.
Who owns verification inside the firm?
Assign responsibility for checking consequential quotations and summaries, addressing incomplete coverage, and keeping the team’s working practices current. Florida Bar Ethics Opinion 24-1 addresses confidentiality and other professional responsibilities when lawyers use generative AI; review the opinion itself for its guidance.
What DiscoRev says today
DiscoRev reads connected Box files without editing, moving, or deleting the originals. It stores cloud copies and review results. Firms have their own workspaces and can control case access. Evidence and results are not used to train AI models.
See DiscoRev’s data-handling overview and ask about your firm’s requirements before connecting a case. The beta application asks about your firm’s workflow; it does not need evidence files or confidential case details.
The printable checklistFive review steps on one page. No email required.OpenCommon questions
Does “not used for training” mean my files are not stored?
No. It answers whether data is used to train AI models. Ask separately which copies are kept, where, for how long, and which providers process them.
Should we test an AI tool with a live case?
Use a synthetic sample while learning the workflow. Avoid confidential case material until the responsible person has reviewed the service’s current terms and data handling.